PHP2Shell: What it means for your business website
Two critical PHP flaws were fixed this week. Here's what Australian businesses on WordPress need to check, and who's responsible for the fix.
In short: Two serious flaws were found in PHP, the software that runs most WordPress websites. Fixes came out on Thursday 22 October 2026. Updating WordPress won't apply them, so check with your web developer.
Hosting with ShadowSafe? Our web hosting was patched Wednesday morning. If your website is hosted with us, there's nothing you need to do. If you're not a ShadowSafe client, get in touch. We can check whether your site has been compromised and recommend a fix.
You probably didn't start this week thinking about PHP. But if your website runs on WordPress, PHP is the engine underneath it. This week, that engine needed an urgent repair.
What happened
PHP is a programming language that powers around 70% of the world's websites. Platforms like WordPress, Joomla and Drupal all run on it.
On Tuesday 20 October, the PHP team warned of two critical security flaws. Details leaked online the same day, before the fixes were ready. ShadowSafe had client websites protected by Wednesday morning, and the official fixes followed just after midnight on Thursday 22 October, Brisbane time.
Researchers have nicknamed the flaws PHP2Shell. Both are rated 9.2 out of 10 for severity. In plain terms, they could let an attacker run their own code on a web server without needing a password.
PHP has always been a target. It runs so much of the web that attackers have been probing it for years. What's changed is the speed. These flaws were found with the help of AI tools, and within a day of the details leaking, security firms were seeing attack attempts.
The Australian Cyber Security Centre (ACSC) issued a critical alert, its highest level. Several government websites, including the ACSC's own, had outages while fixes went in. The ACSC says it isn't aware of active attacks. But security firms including Amazon and Cloudflare have spotted attempts.
Researchers showed the flaws could be used to take over WordPress sites without logging in. For a small business, a compromised website can mean stolen enquiry form details, visitors sent to scam pages, or a hit to your Google ranking.
It’s important to note that updating WordPress, your plugins or your theme won't fix this. The fix sits in PHP itself, on the server your website lives on. Wordfence, a popular WordPress security tool, has warned that automatic WordPress updates won't apply it.
So the person to ask is your web developer. They can confirm whether the server behind your site has been updated.
Who's responsible for the fix
It depends on how your website is set up:
Managed WordPress hosting:
The hosting company usually applies the fix. Some, like SiteGround, protected customers before it was even released. Ask your web developer to confirm it's done.Standard shared hosting (cPanel or similar):
PHP gets updated centrally, but your site may be set to an older version in the control panel. If so, it may still be exposed. Your web developer can check and change this.Your own server, or a site a developer set up and left:
Someone needs to update PHP by hand. If nobody comes to mind, that's worth sorting out this week.Squarespace, Wix or Shopify:
These platforms run their own servers. There's nothing for you to update.
Your PHP version matters. The PHP project only released fixes for version 8.2 and newer, yet around a third of WordPress sites still run something older. Some older versions can be patched by your hosting company, but the safer path is moving to a supported version. That may need a developer to check your plugins still work. If you're on 8.2, plan your next upgrade now. 8.2 stops getting security fixes on 31 December 2026.
How to fix this vulnerability
Find your PHP version. In WordPress, go to Tools → Site Health → Info, then open the Server section. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Ask your web developer to confirm PHP has been updated and restarted on your server. Get the answer in writing.
Check you have a recent backup of your website, stored somewhere other than the website's own server.
Watch for warning signs, like admin users you didn't create, plugins you don't recognise, or your site sending visitors somewhere else.
Get help if something looks wrong. ShadowSafe clients can contact our support team. Anyone else can call the ACSC on 1300 CYBER1 (1300 292 371).
How ShadowSafe can help
If you're not sure who looks after your website's server, you're not alone. Many businesses had a site built years ago and haven't thought about it since. We can check whether your site is patched and running a supported PHP version.
This won't be the last alert like this. AI is helping people find software flaws faster, and attackers are moving faster too. Expect more serious alerts, with less time to act on each one. It’s another reason to treat cyber security as an essential part of running your business, with the right partner keeping watch while you're busy with everything else.
Call our team on 07 3185 1777 to discuss how ShadowSafe can help your business grow with confidence online.
This article was written on October 23rd of October.
