PHP security alert: what Australians should check now

Checked 24 October 2026 AEDT

If your website uses PHP, ask your hosting provider to confirm the emergency security fixes are in place now. A WordPress dashboard showing everything is up to date does not confirm that the server underneath it has been patched. WordPress says these vulnerabilities need a PHP update, not a WordPress core update. WordPress security notice

Then work through the business and personal checklists below. Updating a laptop or browser is worthwhile, but it does not fix PHP running on your website’s hosting server.

Take extra care and act promptly. Know what needs attention, who is doing it and how you’ll confirm it’s done.

What happened with PHP?

PHP helps run websites on a web server: the computer system that delivers a site to visitors. Its emergency fixes became available on 22 October AEDT, following the 21 October UTC release. The two critical flaws, CVE-2026-109618 and CVE-2026-109619, could let an attacker run code without logging in. PHP installations handling web requests are in scope. PHP advisories

The emergency fixes were released in these PHP versions:

Emergency PHP fix versions, checked 24 October 2026

PHP branch	Emergency fixed version
8.2	8.2.35
8.3	8.3.36
8.4	8.4.27
8.5	8.5.12

A hosting vendor may supply a backported fix, meaning the security repair is applied to its existing package. Ask for confirmation rather than judging by the version label alone. PHP 8.1 and earlier no longer receive normal PHP-project security updates. PHP release guidance

There is a follow-up to check. PHP’s 23 October notice describes another, unlikely code-execution route involving an unusual combination of session configuration and application code. Ask your host to review that advice too. Leave server configuration changes to the technical maintainer. PHP session advisory

Why the wider security checks matter

This has prompted precautions in Australia too. On 22 October, the NSW Government said some of its websites were temporarily taken down while patches were applied. It also said no NSW Government agencies had reported information breaches to Cyber Security NSW at that date. NSW Government statement

GovCMS, the government website platform, reported its maintenance complete on 23 October. Its investigation had not identified unauthorised access or compromise, including customer data, at that point; assessment was continuing. GovCMS status update

Japan’s Hokkaido Bank also reopened its Rapid loan website after precautionary security checks. Precautions are not proof of compromise. Hokkaido Bank notice

More broadly, Microsoft’s 2026 global threat report describes AI increasing the speed and scale of some attacks, while familiar routes through people, accounts and exposed systems remain important. Microsoft’s findings

Apply that caution even when a message names a familiar business, bank or government service. Verify unexpected login or payment requests through a trusted contact method, rather than the details supplied in the message. ACSC advice on impersonation and phishing

Send your host this question

You don’t need to diagnose a server yourself. Send this to whoever manages your hosting:

Could you confirm whether our website or web applications use PHP, and whether every relevant installation has received the fixes for CVE-2026-109618 and CVE-2026-109619? Please confirm the patched package or vendor backport, any required service restarts, and your review of PHP’s 23 October follow-up advice. Have backups and key website functions been checked, and do logs or unexpected changes need investigation? If anything cannot be patched promptly, what immediate protective action do you recommend?

Include your website address and other sites the provider manages. Keep the reply. If responsibility is split between a host and developer, clarify who is handling each part.

If your provider has already confirmed the patches, keep that confirmation rather than arranging the same work twice. Still ask about PHP’s 23 October follow-up and ongoing maintenance.

Business checklist: assign an owner to each category

Start with the PHP confirmation. The remaining checks are ongoing security maintenance, not substitutes for that fix.

1. Website and hosting

Owner: hosting provider and website maintainer. Priority: now.

• List live websites, web applications, staging sites and old sites still online. Ask which use PHP.
• Get written patch confirmation for each relevant installation, not just the main website.
• Ask the maintainer to test important functions after the change, such as enquiries, logins, bookings and checkout where applicable.
• Keep routine website, plugin and theme updates on the maintenance list separately.

In WordPress, the PHP version is under Tools → Site Health → Info → Server. Use it to start the conversation, not as a complete security assessment. WordPress guidance

2. Computers, phones and other devices

Owner: IT provider or nominated team member. Priority: check promptly.

• Check operating-system updates on work computers and phones, including spare or infrequently used devices.
• Include routers and other business equipment in the update inventory.
• Turn on automatic updates where available and finish required restarts.
• Flag products that no longer receive security updates and agree on a supported replacement or migration plan.

Use the ACSC’s device-specific instructions for Apple, Google and Microsoft, and record any updates still outstanding.

3. Browsers and apps

Owner: each staff member, supported by IT. Priority: check promptly.

• Check browsers, email software, PDF readers and other work apps through their legitimate update settings.
• Close and relaunch applications when an update requires it.
• Ask IT to resolve failed updates rather than repeatedly dismissing them.

For Chrome on a computer, open Help → About Google Chrome, then select Relaunch if offered. A downloaded update may still be waiting for that restart. Google’s Chrome update instructions

4. Accounts and access

Owner: account administrator or business owner. Priority: start with critical accounts.

• Check email, hosting, domain registration, website administration, cloud storage and social accounts.
• Use multi-factor authentication (MFA) or passkeys where supported, and unique passwords stored in a password manager.
• Remove access that former staff or contractors no longer need. Give current staff only the permissions their work requires.

See the ACSC’s account security basics and access-control guidance.

5. Backups and recovery

Owner: whoever manages backups, with a business owner checking the outcome. Priority: verify now.

• Confirm what is covered, including website files, databases and important business records.
• Ask when the last successful backup ran, where copies are kept and who can access or delete them.
• Ask when recovery was last tested. Restoring a sample file is useful, but business recovery may also need applications and settings restored together.
• Keep backups protected from the same incident that could affect everyday systems.

The ACSC explains why both protected backups and tested restoration matter in its backup and recovery guidance.

6. Staff awareness and reporting

Owner: business owner or team leader. Priority: make the process clear now.

Tell staff who to contact about suspicious messages, unexpected login prompts or unusual activity. Independently verify changed payment details with a known contact before acting. Keep the host’s and IT provider’s contact details somewhere accessible if normal systems are unavailable. ACSC staff guidance, incident planning guidance

Personal checklist: your own devices and accounts

These checks improve everyday security. They do not patch websites you visit.

Devices

Check your phone, tablet and computer for operating-system updates. Enable automatic updates where available, complete restarts and check whether older devices still receive security fixes. ACSC update guidance

Browsers and apps

Open the browser’s update screen and your device’s official app store to check for updates. Review app permissions and remove apps you no longer use. Don’t install a supposed security fix from an unexpected pop-up or message. ACSC device guidance

Accounts

Start with your main email account, then banking, social media and cloud storage. Enable MFA where available. Use a different, strong password for each account and protect your password manager too. ACSC MFA guidance, password guidance

Backups

Check that important photos and documents have a recent backup you can restore. Keep an offline copy where practical, and disconnect external backup drives when not in use. Choose a frequency that reflects how often your files change. ACSC backup advice

Personal websites

If you run a personal blog or other PHP website, use the hosting question above. The responsibility follows the website, even when it isn’t part of a business.

Common questions

Does this mean my website has been hacked?

Not necessarily. A vulnerable installation and a confirmed compromise are different findings. AWS reported an exploitation attempt against a monitoring system on 17 October, before disclosure. That supports prompt action, not a claim that every website was compromised. AWS investigation

If the patch is installed, is the job finished?

Not necessarily. A patch does not rule out earlier compromise. Ask your provider whether logs need investigation and confirm it has checked the later PHP advice. This follows from the AWS findings and investigation advice.

Do I need to change every password?

Not solely because a PHP advisory was published. Replace reused passwords and change credentials you believe are compromised. Follow your provider’s incident-specific advice if an investigation identifies exposure. ACSC password advice

What if the provider cannot patch promptly?

Escalate to the technical provider. A web application firewall does not replace patching. CISA advises taking affected PHP systems offline if they cannot be updated immediately. Ask the provider to manage the appropriate action for your service, rather than changing unfamiliar settings yourself. CISA advisory

Do I need to stop using the internet?

The PHP alert is a reason to check affected hosting, not evidence that every online service is compromised. Follow specific advice from your providers and the ACSC, and verify unexpected requests independently.

If you suspect compromise

Contact your host or IT provider promptly. Record what you noticed and when, and ask them to preserve relevant logs and evidence while containing the issue. Don’t assume an update removes an existing intrusion. The ACSC explains evidence preservation and how to get help during an incident. You can also use its official reporting service.

Start with one clear action: send the hosting question. Then give every unfinished business check an owner, and work through your personal checklist separately.

Related guidance: Review your WordPress maintenance report and website hosting and maintenance.