If you noticed websites showing maintenance pages this week, there is a good reason. PHP, the programming language behind close to 70% of the world’s websites, has released emergency fixes for two critical security flaws, nicknamed “PHP2Shell”. Governments in Europe temporarily took sites offline while they patched, and the ABC reports that the Australian Signals Directorate, whose own cybersecurity site was among those affected, has joined other agencies urging organisations to act quickly.
What is the problem?
The two flaws (CVE-2026-109618 and CVE-2026-109619) are each rated 9.2 out of 10 for severity. They sit in PHP itself, not in any one website, so a site can be exposed even if its own software is fully up to date. A successful attack could let someone run their own code on your web server without needing to log in.
PHP sits underneath WordPress, Joomla, Drupal, Magento and many other systems. If your business website, online shop or booking page runs on one of these, it almost certainly uses PHP. Security researchers say working exploit code is now available, and there are reports of attacks, so this is not one to leave until next month.
What should you do?
- Ask whoever hosts or manages your website whether the server has been updated. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs an older version than these, ask what the plan is.
- Do not rely on workarounds. The PHP team says only installing the update fully protects a server. Firewall rules from providers such as Cloudflare help, but they are a stopgap.
- Check for anything unusual once patched, such as new admin accounts, unfamiliar plugins or files, or unexpected changes to your pages.
- Make sure you have a recent backup of your site that is stored somewhere separate from the server.
If your site is on shared hosting, your provider may have already patched it, but it is worth a quick email to confirm rather than assuming. A brief outage while the update goes on is far better than a website quietly taken over.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.
Sources
- ABC News: Australia’s cybersecurity site among those hit by ‘critical’ software flaw
- Malwarebytes: PHP2Shell – why websites are going offline for emergency security updates
- The Hacker News: PHP issues emergency patches for two critical PHP2Shell RCE flaws
- The Guardian: Flaw in PHP computer language leads to shutdown of websites around world
- Krebs on Security: Widespread PHP flaw may cause many site outages today
- Cloudflare: Protections against PHP vulnerabilities