Security notice
Two critical vulnerabilities in PHP itself
PHP, the language WordPress, WooCommerce, Magento and most content management systems run on, has two critical flaws, both rated 9.2 out of 10. The fixes are due at 1:00am AEDT on Thursday 22 October 2026, and the ASD says every version from PHP 5 onwards may be affected. If your website runs on PHP, make sure whoever manages its server is ready to update the moment the release lands.
What's happening
On 20 October 2026 the PHP security team gave advance notice of a security release fixing two critical vulnerabilities in PHP, both rated 9.2 out of 10. It is scheduled for 14:00 UTC on 21 October, which is 1:00am AEDT on Thursday 22 October. The team has said it may release sooner if details become public or attacks begin.
The ASD's Australian Cyber Security Centre issued a critical alert the next day. It says media reports identify the flaws as CVE-2026-109618 and CVE-2026-109619, and that all PHP versions from PHP 5 onwards may be affected. The official details, the affected versions and the fixed versions will only be published with the release.
Researchers who have seen the details describe both as remote code execution: a way for an attacker to run their own code on a server running PHP. The details have already leaked, one security firm says it has reproduced one of the two flaws, and another expects mass attacks within minutes of the release. When it issued its alert, the ASD said it was not aware of any active exploitation.
You can read the ASD's alert on its Cyber.gov.au site.
Who is at risk
- Any website or web application that runs on PHP. That includes WordPress, WooCommerce, Drupal, Joomla, Magento and most other content management systems and online stores.
- Servers on PHP 8.1 or older. PHP only supports 8.2 and later, so older versions are not expected to get an official fix. They will need a patch backported by the host, or a move to a supported version.
- Sites on a server someone else manages. The fix is an update to the server, not to the website, so it depends on whoever runs the server.
What to do if your website runs on PHP
- Find out which PHP version each site you're responsible for runs. In WordPress it's under Tools, Site Health, then the Info tab, in the Server section.
- If someone else manages your hosting, contact them today. Ask them to confirm they will apply the update as soon as it's released, and to tell you when it's done.
- If you manage the server yourself, plan to update PHP the moment the fixed versions are out.
- If you're on PHP 8.1 or older, ask your host whether they will backport the fix, and plan the move to a supported version.
- Once you've updated, watch for signs of compromise: files you didn't put there, administrator accounts you don't recognise, and unexpected outbound connections from the server.
How this affects our clients
PHP is part of what we look after on the WordPress sites we manage. We're tracking this release and will update PHP on those sites once the fixed versions are out.
Our Jigsaw sites are a different story. Jigsaw is our own website platform, the one we build on and move clients onto in place of WordPress for most small business sites. A Jigsaw site is put together from its content, images and design before it goes live, so when someone visits, no PHP runs to build the page, and there is no database, no plugin and no admin login behind it. That leaves flaws like these very little to reach. We'll still update PHP wherever it's installed on the servers we look after. You can read more about Jigsaw.
If you'd like us to check which PHP version your site runs, or whether your host is ready for this release, request a chat.
