Updating WordPress, Drupal or a plugin will not close the PHP flaws that took government websites offline this week. The vulnerable code sits in the PHP engine underneath them, so every server, appliance and hosting platform running PHP has to be found and updated.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, are both rated 9.2 under CVSS version 4.0. The PHP project fixed them in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October.
PHP says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
Wiz Research, which reported the flaws, says they are independent of the application running on top. In its technical write-up, Wiz says even a simple "Hello World" application on an affected version can be vulnerable.
One of the flaws also allows an attacker to read memory from the PHP worker process without logging in. Wiz says that memory can hold passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.
In Australia, cyber.gov.au was among the government websites hit by outages as mitigation work went on. "Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability," a spokesperson for Home Affairs Minister Tony Burke told the ABC.
It was reported that the Australian Taxation Office, Department of Health and ACMA websites also appeared limited. AAP reported that the Parliament of Australia site was down for maintenance at one stage on Thursday morning.
ASD's Australian Cyber Security Centre issued a critical alert, updated on 22 October once patches were available. It advises organisations to identify PHP in their environments, apply updates and other mitigations, and monitor PHP applications for suspicious activity.
The ACSC said all PHP versions from PHP 5 onwards may be affected, and that it was not aware of active exploitation. Cloudflare chief technology officer Dane Knecht said early attacks were emerging, describing its firewall rules as a "STOPGAP only".
Older versions and hidden instances
PHP 8.1 and older no longer receive updates from the PHP project. Given the severity, the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1 for those building from source. Otherwise, users of older versions depend on their distribution or long-term support vendor.
PHP 8.2 reaches end of life on 31 December 2026 and will receive no security fixes after that date.
PHP says Linux distributions and support vendors received the patches in advance. It urged users of the volunteer-run remirepo package repository to switch to distribution packages or build from source. That repository would not be updated immediately.
Don Smith of the Sophos Counter Threat Unit told the BBC the immediate challenge was finding every instance of PHP, not just installing a patch. He said PHP can sit beneath hosting platforms and third-party products without being obvious to the organisation using it.
The UK's National Cyber Security Centre has advised organisations to keep monitoring third-party vendors for updates once PHP itself is patched. That includes appliances and services that bundle PHP. Where immediate remediation is not feasible, it says systems should be considered for taking offline.
For servers that cannot be updated straight away, PHP lists configuration changes that reduce exposure to specific attack paths. They include disabling session upload progress tracking and tightening memory and request size limits, with every worker restarted afterwards.
PHP stresses that these measures do not make an installation safe. Only the update is a complete fix.
Wiz says the attacks run below the application layer, so application logs may record little. It suggests watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses. Oversized or malformed PHPSESSID cookies and unexplained PHP worker churn are also warning signs.
The flaws had existed for more than a decade. Wiz says frontier AI models made it practical to adapt the exploit to different PHP versions, configurations and memory layouts. That lowers the barrier to running attacks at scale.
Michael Leland, field CTO at Island, told Axios that defenders have long used the gap between vulnerable and exploitable to buy patching time. "That gap is rapidly closing," he said.