If you run an Australian business and have a website, then there has been a critical security alert that affects your business.
There’s a critical vulnerability with PHP, which is the system that powers many websites, including content management systems like WordPress.
Many of the popular and current website hosting companies, like WP Engine, Cloudways, and Ventra IP, are already making significant progress with patching this update or have completely fixed the patch here. But this does not mean that your website is protected forever.
Simply updating to this version of PHP, the latest version, may break some parts of your website. The first thing you need to do is make sure that your web host is patching the update to keep your website secure. The next thing is to work with your web development team to make sure that your website is functionally working in the new update.
If you run a mission-critical website and your PHP version is not up to date, you are at severe risk of not just being hacked from a reputational standpoint, but of information being stolen from your website. This is a critical vulnerability and requires immediate attention.
If you’re looking for help with support and maintenance for your website from a security and performance perspective, get in touch with our team.
How we’re supporting our clients
What’s the issue?
PHP is the programming language behind a large share of the web, including every WordPress website.
On 21 October the PHP team announced two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and released fixes, and the Australian Cyber Security Centre (ACSC) has issued an alert recommending everyone update.
What’s the impact?
In plain terms, these vulnerabilities could let an attacker take control of a website remotely, without needing a login, which is why they’ve been given the highest severity rating.
The ACSC says it isn’t aware of any successful attacks in Australia so far, and the fixes went out quickly, so the risk has been addressed early.
Are you affected?
If your website is hosted with us, it runs on either WP Engine or Cloudways, and both have moved quickly:
- WP Engine finished applying the security patches across their platform on 21 October, covering every PHP version our websites run on.
- Cloudways has put interim protections in place across their whole platform and is finishing the rollout of the full patches today, again covering every PHP version, including older ones.
So there’s nothing you need to do. We’re also checking every website individually to confirm the patch is in place.
What’s been done?
As well as confirming the patches, we’re looking at the websites still running older versions of PHP (7.4 and below). They’re protected against this issue, but those versions no longer get regular security updates.
Over the coming weeks we’ll let those clients know and recommend moving to a current version, so the website stays secure into the future.
If your website isn’t hosted with us please contact your web host or IT team so they can confirm the update has been applied.
