What happened, and does it affect you?
On the morning of Thursday 22 October I read that cyber.gov.au had gone offline, along with local councils and government services across Europe. My first thought was for the sites of the businesses we look after, so I checked every one of them before doing anything else.
If you run a small business you’re probably asking the same thing: is my website one of them, and what do I need to do? This piece gives you the answer, the exact message to send your host, and a case for treating it as more than a patch.
Two security firms found two flaws in PHP, the language underneath about 70 per cent of websites by Wiz’s estimate. Details leaked a day before the fix was published at 1am AEDT on 22 October, and Amazon had already seen an attack attempt on 17 October. Most attempts so far haven’t worked, but an unpatched site isn’t safe.
If your site is WordPress, WooCommerce, Drupal, Joomla or Magento, it runs on PHP. If it’s on Shopify, Squarespace or Wix, there’s nothing for you to patch, because they run their own servers. If a developer built it for you, ask them.
What should I do today?
Your host or developer does the update. Your job is to make sure it happens and get it confirmed in writing. Here’s a message you can send as it is:
“Hi, I’ve seen the news about the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Can you confirm the fixes are installed on the server my website runs on, and that PHP has been restarted since? Which PHP version am I on? If it can’t be done today, what do you recommend in the meantime? Thanks.”
Updating WordPress or its plugins won’t fix this, because the flaw sits in PHP underneath. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but some hosts patch older-numbered versions, which is why the message asks for confirmation rather than a number. If you’re on WordPress you can check the version yourself under Tools, then Site Health, then the Info tab, under Server. If you’re on PHP 8.1 or older, there’s no official fix for that at all, and it’s the clearest sign a site has been left alone too long.
If your host can’t fix it within a day or two, taking the site offline until they can is a sensible precaution. Steve at ITNode did that for one of his customers on Thursday, starting by pointing the domain away from the server. Repointing the domain only hides the site, though, because the server is still reachable at its own address, so it needs blocking at the host too. A few days of a maintenance page costs far less than a breach, especially for an online store holding customer details.
ITNode explains how to take a site offline safely, step by step.
The ASD’s alert on the PHP vulnerabilities is the Australian reference, and its hotline is 1300 CYBER1 if you think you’ve been compromised.
Why this is a forced audit, not just a patch
The update takes a host minutes. What struck me checking those sites was how long it took some businesses to work out who to ask, because the developer had moved on and nobody was sure which plugins still did anything.
I call that a forced audit. Every few years something outside your control makes you look at your website properly, and most businesses patch whatever broke and stop there, paying for the stress without keeping what it told them.
So while you’ve got the site’s attention, ask four questions. Who would notice if it went down tonight? When was it last properly maintained, and are you on PHP 8.1 or older? Is it bringing in enquiries, not just visits? And could ChatGPT or Google’s AI Mode describe what you do from your site alone?
If the answers are fine, patch and move on. If two or more make you wince, PHP2Shell has told you something worth acting on.
If you rebuild, build it to be found in AI answers
Don’t rebuild the same site on newer software. More searches now end in an answer rather than a list of links, whether that’s a Google AI Overview or a ChatGPT reply, and one business gets named while the rest don’t appear. Getting named is what answer engine optimisation, or AEO, is about, and a rebuild is the cheapest moment to build it in.
That means pages with a heading that matches the question people ask and a plain answer underneath, structured data that tells search engines what your business is and where, and a fast site. Build it as static pages with no PHP running when someone visits, and there’s far less to go wrong in a week like this one.
Our site and ITNode’s are built that way, so neither needed patching. On 25 August 2026, Google’s AI Overview for “dental it support” named ITNode first among Victorian providers, citing a heading and the sentence under it word for word. Leaving PHP didn’t cause that, writing the page to answer the question did, but the rebuild made room for it.
Patching the website is the marketing side of PHP2Shell. The IT side goes further, because PHP also hides in control panels, office software and network devices, and ITNode has covered that part.
If you’re new to the idea, start with what AEO is and how it works.
If you look after more than a website, read ITNode’s guide to PHP2Shell for the security side.
When a rebuild isn’t the answer
If your site is a few years old, maintained, on a host that’s already patched it and bringing in enquiries, you don’t need a new one. Patch it, confirm the fix and get on with your week. Be wary of anyone using PHP2Shell to sell you an urgent rebuild, and I include us in that. The patch is urgent and the rebuild isn’t, so give yourself a month and decide then.
For more on how search is changing, see getting cited in AI answers, or
get in touch if you’d like a second opinion on your site.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the nickname for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, made public on 22 October 2026. They can let an attacker with no login run code on a web server running PHP, which includes most WordPress, Drupal, Joomla and Magento sites.
Is my WordPress site affected by PHP2Shell?
Almost certainly, unless your host has already applied the fix. The fix is updating PHP on the server, not updating WordPress or its plugins, so ask your host to confirm it's installed and PHP has been restarted.
Do I need to do anything if my site is on Shopify, Squarespace or Wix?
No. Those platforms run their own servers and handle their own security updates, so there's nothing for you to patch. Any separate tools you run outside the platform, such as a booking system or client portal, are worth checking with whoever set them up.
Should I take my website offline?
Only if your host can't apply the fix within a day or two. If you do, block the site at the host as well as repointing the domain. For an online store holding customer details, a few days of a maintenance page costs far less than a breach.
Should I rebuild my website because of PHP2Shell?
Not because of the flaw alone, so patch first and then ask whether the site is maintained and bringing in enquiries. If it isn't, plan a rebuild and build it to be found in AI answers as well as Google.