URGENT: Critical PHP Vulnerabilities Put WordPress and Business Websites at Risk

SwiftTech Urgent Cyber Security Alert | 23 October 2026

Australian businesses should check their website hosting today. Two newly disclosed critical security flaws in PHP could allow an attacker to take control of a vulnerable website server without knowing a password. The issues are identified as CVE-2026-109618 and CVE-2026-109619.

PHP is the behind-the-scenes technology used by many websites, including WordPress, online shops, booking systems and custom business applications. You may use it without ever seeing its name. The Australian Cyber Security Centre (ACSC) has issued a Critical alert, and the PHP project released emergency security updates on 21 October 2026.

The important message is straightforward: check which version of PHP runs your website, ensure the security fix is installed, and ask your provider to review the server for suspicious activity. This is not a reason for every business to switch off its website immediately, but it is not an update to postpone.

What happened?

Security researchers identified two serious weaknesses in how PHP handles certain web requests and memory. Under the right conditions, an attacker could exploit them to run their own instructions on an affected server. Security professionals call this unauthenticated remote code execution: in plain English, someone on the internet may be able to make a vulnerable server run malicious commands without first signing in.

The PHP development team released fixes on 21 October 2026. The flaws have been reported with critical severity scores of 9.2 on the CVSS 4.0 scale. Authorities in Australia, the United Kingdom and Europe have urged organisations to act. Some overseas organisations temporarily took websites offline as a precaution while arranging updates. Sky News reported on the international response.

Keep the risk in perspective: PHP is used by a very large proportion of websites, but that does not mean that every PHP website has been compromised. As of its latest update on 22 October, the ACSC said it was not aware of confirmed successful exploitation in Australia linked to these vulnerabilities. That assessment can change, so installing the fixes remains urgent.

Could your business website be affected?

Potentially. PHP runs behind popular website and web-application platforms. Your business may be exposed if your hosting server runs an affected version, even when the WordPress dashboard says the website itself is up to date.

Businesses should pay particular attention to:

• WordPress websites and online stores, including sites using WooCommerce;
• Other PHP-based websites, booking systems, customer portals and e-commerce software;
• Custom business applications hosted on public-facing web servers;
• Third-party software or appliances that include their own copy of PHP;
• Older websites using unsupported hosting software or versions of PHP.

If someone else manages your website, ask them to check. You do not need to be a developer to request proof that the server has been updated.

Which PHP versions need updating?

The PHP security team and Canada’s Cyber Centre identify these minimum fixed releases:

Some managed hosting and Linux providers deliver equivalent fixes through their own patched packages without changing the displayed version number. If that applies, ask your provider for written confirmation that both vulnerabilities have been addressed. Do not assume an old version number means a provider has ignored the issue, or that a simple WordPress update has fixed it.

What could happen if a vulnerable server is attacked?

Depending on what the website and hosting account can access, a successful attack might allow criminals to steal business or customer information, change website content, interfere with online bookings or sales, install malicious files, or use the server to reach connected systems. The precise impact depends on the server configuration and how securely the website is isolated from other services.

For a small business, even a temporary outage can be expensive. A compromised website can interrupt enquiries, payments and customer confidence. That is why it is important to combine patching with good backup and recovery arrangements.

Five things Australian business owners should do today

1. Ask your website provider which PHP version is running

Contact your web host, developer or IT provider and request a check of the PHP version actually serving your website, not just what appears in the WordPress dashboard. If you run several websites, make sure every hosting account and server is included.

2. Confirm that both security fixes have been applied

Ask your provider to confirm that CVE-2026-109618 and CVE-2026-109619 are fixed in the installed PHP release or vendor-patched package. An upgrade may need compatibility checks, especially on older websites, but it should be prioritised and carried out promptly.

3. Check for signs of suspicious activity

Ask the technical team to review relevant server and application logs, unfamiliar administrator accounts, unexpected file changes and unexplained outbound connections. A successful update prevents known vulnerable behaviour; it does not automatically remove anything an attacker may already have installed.

4. Verify your backups and recovery plan

Make sure recent backups exist, are stored securely and can actually be restored. A backup that has never been tested can give a false sense of security. Our data protection services can help businesses plan recoverable website and business-system backups.

5. Act promptly if the host cannot patch

If your hosting provider cannot verify the fix, request a clear remediation timeframe and temporary protection plan. For high-risk internet-facing systems that cannot be safely updated, security authorities advise considering temporary isolation or taking the affected service offline until the risk is addressed. This should be a coordinated decision that considers customer access and business continuity.

Does a WordPress plugin update solve this?

No, not by itself. WordPress, themes and plugins should still be kept updated, but these two vulnerabilities are in PHP itself — the technology running on the server. Your hosting provider normally controls the PHP installation. Even fully updated WordPress sites can be at risk if the underlying server is running vulnerable PHP.

Businesses with managed WordPress hosting should ask their provider whether they have already applied the PHP security update across their hosting infrastructure. Many hosts may have done so automatically, but it is sensible to confirm.

How SwiftTech can help

Official security information

• Australian Cyber Security Centre — Critical vulnerabilities in PHP
• PHP development team — 21 October 2026 security advisory and fixed releases
• ENISA and European cyber authorities — Joint statement
• Canadian Centre for Cyber Security — Affected and fixed versions

Information checked 23 October 2026. Exploitation information and vendor guidance may change as investigations continue.