Critical PHP vulnerabilities put business websites at risk
Best Practices
Small Business
Government
Posted By - Court Sayer-Roberts
28 October, 2026
0 Comments
Australian businesses with websites or online systems running PHP are being urged to check that security updates have been applied. The Australian Cyber Security Centre (ACSC) has rated the issue critical. PHP is widely used to run websites and applications, including many built with WordPress, Drupal and Joomla. The issue is in the PHP software that runs on a web server; it is not simply a flaw in those website platforms themselves. business.gov.au
The vulnerabilities could let an attacker send a request over the internet and run commands on an affected server without first logging in. If exploited, this could enable changes to website content, theft of information the server can access, or disruption to the site. A compromised server could also be misused to send spam or attack other systems. These are possible consequences, not evidence that any particular business website has been breached.
The PHP development team has released fixes and says all PHP installations serving web requests may be at risk. The fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Businesses do not need to identify or install the update themselves if their site is managed by a hosting provider or web developer, but they should confirm the work has been done. Older PHP versions may need a patch from the hosting or software vendor, or an upgrade to a supported version.
What business owners can do now:
Ask your web host, developer or IT provider:
Is my website or any connected application running PHP?
Have you applied the fixes for CVE-2026-109618 and CVE-2026-109619, or a vendor-provided equivalent?
Have you checked for suspicious activity and confirmed backups are available?
The Australian Cyber Security Centre(ACSC) recommends applying available updates and monitoring PHP applications and related systems for unusual activity. In its review on 22 October, it said it was not aware of successful exploitation in Australia at that time.
