Most small business websites run on a piece of software called PHP. WordPress does, and so do Joomla, Drupal and Magento. You never see it, in the same way you never see the plumbing, which is exactly why this week matters.
On 21 October two critical flaws in PHP were made public. The security industry has nicknamed them PHP2Shell. The Australian Signals Directorate’s ACSC issued a critical alert, its highest rating, and cyber.gov.au itself was taken offline for a period along with some other government sites while the risk was dealt with.
The flaws (CVE-2026-109618 and CVE-2026-109619) let an attacker run their own code on a web server without logging in. From there they can plant malware on your site, copy customer details, read the password your site uses to talk to its database, or quietly use your site to host scam pages. Amazon’s threat intelligence team saw an exploit attempt four days before the flaws were announced, and attacks have been reported since, so this is already being used.
Why updating WordPress will not fix it
This is the part that catches people out. The flaw is not in WordPress, your theme or your plugins. It is in PHP itself, which sits underneath all of them on the server.
So you can update every plugin you have and still be wide open. Security plugins cannot stop it, because the attack lands before WordPress has even loaded, and a website firewall in front of your site is a stopgap rather than a fix.
The fix has to happen on the server. If you are on shared hosting, which most small businesses are, that is your hosting company’s job. If you have your own server, or a developer looks after one for you, it is theirs. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are already out of support, so they only get a fix if your host or its server software supplier adds one, and the oldest versions get none at all.
The one question to ask
Email your web host, or whoever looks after your website, and ask:
Has the PHP2Shell fix been applied to the server my website runs on, and what PHP version am I on now?
You are after two things: a clear yes, and a version number that matches one of the patched releases above. “We have a firewall in place” is good, but it is not the same thing. Keep asking until you get a straight answer about PHP.
The big hosts have most likely done it already. Ask anyway. Plenty of small business sites sit on a cheap plan set up years ago by someone who has long since moved on, and those are the servers that get missed.
Do this: send the question today, in writing, so you have a record of the answer and when you got it.
Check it yourself in two minutes
If your site is on WordPress you can see the PHP version without asking anyone. Log in, go to Tools > Site Health > Info, and open the Server section. If the version starts with 7, 8.0 or 8.1, you are on an old release and need to move to a supported one as well as get the patch.
One caution: some hosts apply the fix without changing the version number, so a correct looking number is reassuring but the host’s answer is what counts.
Do this: note the version down, and while you are logged in, update WordPress, your theme and plugins anyway. It will not fix this one, but it closes other holes.
Make sure you could recover
A hacked website is survivable if you have a clean copy to put back. Most hosts offer daily backups, often as a low cost add on, and a good setup keeps copies for at least 30 days so you can go back to before the break in.
Do this: find out where your website backups are and how far back they go. If the answer is “I think the host does that”, get it confirmed in writing along with the PHP question.
The problem with doing it yourself
You can do all of this yourself this week, and you should. What a checklist cannot tell you is what else is sitting open. The old staff login that still works, the mailbox rule nobody remembers creating, the router that has not had a firmware update since it was installed.
That is what our Security Snapshot is for. It checks the six areas that actually get businesses breached, from your network and Microsoft 365 to your email domain and the dark web, and gives you a plain English report with what to fix first. It is a fixed $297 including GST, the report is with you inside 48 hours, and there is nothing to sign up to afterwards. If you would rather start smaller, the free 2 minute risk check is a good first look.
Either way, one email to your host this week is a very cheap way to avoid a very expensive problem. If you get stuck, get in touch and we will happily have the conversation with your host for you.
Questions people ask
My website is just a brochure site with no logins. Do I still need to worry? Yes. Attackers do not care what your site is for. A hacked brochure site gets used to host phishing pages and push malware to visitors, which can get it flagged in Google, and you usually find out when a customer tells you.
I use Squarespace, Wix or Shopify. Does this affect me? Not in the same way. Those platforms run and patch their own servers, so there is nothing for you to ask or update. This mostly affects WordPress, Joomla, Drupal and Magento sites on standard web hosting.
My host says they have patched it. Is there anything else to do? Keep your backups current, update WordPress and your plugins, and if your site has been on an old PHP version for years, ask about moving to a supported one so you are not caught out next time.