Adelaide owned and operated, IT & Digital + Web since 2001→
WaTo Consulting

Critical PHP vulnerabilities (PHP2Shell): what it means for your website

In October 2026 the PHP project fixed two critical flaws that let an attacker run their own code on a web server without logging in. PHP runs most small business websites, including almost every WordPress site, so if your site has a contact form, a shop or a login, this one matters. WaTo hosting is already patched.

Last updated

Call us(08) 7123 0805 Get a quoteNew work or advice Log a jobSomething not working?

The short answer

CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, are critical flaws in PHP itself that can let an attacker run code on a web server without a password. Fixed releases came out on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The Australian Cyber Security Centre has issued an alert. Websites hosted by WaTo are patched. If your site is hosted elsewhere, ask your host to confirm the fix, then change any passwords and API keys stored on the site.

What the flaws are

PHP is the programming language most websites run on behind the scenes. These two flaws are in PHP itself, not in WordPress or a plugin, so a site can be fully up to date and still be exposed if the server's PHP isn't patched. One corrupts memory when PHP runs short of it. The other lets leftover data from one visitor's request be misused in the next. Either can be used to take over the site's files.

Who's affected

Any website running PHP

WordPress, WooCommerce, Joomla, Drupal, Magento and custom PHP sites all run on it.

Every common server setup

Apache, LiteSpeed, PHP-FPM and the rest. The PHP project says every installation that serves web pages is at risk.

Older PHP versions

PHP 8.1 and older get no official fix. Sites still running them should move to a supported version.

Sites that hold keys

Sites that store payment or API keys, such as Stripe, PayPal or email sending keys. A break-in can expose those keys.

Who this is for

  • Business owners whose website runs on WordPress or another PHP system.
  • Anyone who got a warning about PHP from Stripe, a payment provider or their host.
  • Web designers checking client sites on shared hosting.

What to do now

  1. Confirm the fix with your host. Ask whether PHP on your server has the October 2026 update. On shared hosting you can't patch PHP yourself. The host has to.
  2. Move off old PHP. If your site runs PHP 8.1 or older, switch it to 8.2 or newer in your hosting panel, then check the site still works.
  3. Change your keys. Patching closes the hole but doesn't undo a break-in that happened before it. Change your passwords and roll any payment or API keys stored on the site.
  4. Look for signs of trouble. Check for files you didn't add, new admin users, and charges, refunds or payouts you don't recognise in your payment dashboard.

How WaTo can help

  • Our hosting servers are patched for both flaws. Current advisories are on our server status page.
  • We'll check a site hosted elsewhere and tell you plainly whether its PHP is exposed.
  • We can move your site to patched hosting and help you change keys safely.

PHP vulnerability questions

Is my website affected?

If it runs on PHP and the server hasn't been updated since 21 October 2026, probably. WordPress, WooCommerce and most cPanel hosted sites run on PHP. Your host can tell you which version you're on.

Is WaTo hosting patched?

Yes. Our hosting servers are patched for CVE-2026-109618 and CVE-2026-109619. The server status page lists current security advisories.

Will updating WordPress fix it?

Keeping WordPress updated is always worth doing, but it won't fix this. The flaw is in PHP on the server, so the host has to patch it.

I got an email from Stripe about PHP. What should I do?

Stripe sends these when a site looks like it runs an unpatched PHP version. Get the server patched first, check your Stripe request logs for anything you don't recognise, then roll your API keys. If we host your site, call us and we'll go through it with you.

What if my site is on PHP 7 or 8.0?

Those versions have no official fix. Move to PHP 8.2 or newer. If the site breaks on a newer version, that's a sign it needs work anyway, and we can help.

How WaTo can help with this

Guides on this topic

Sources & references

WaTo Consulting. Last reviewed 2026-10-23. Review when the PHP project or the government updates the advisory.

Not sure if your site is patched?

Give us a call and we'll check your hosting and tell you straight.

Mon to Fri, 8:30am to 5pm

Call (08) 7123 0805 Get a quote

No two businesses are the same, so nothing we do is off-the-shelf. Every solution is built around yours, and kept simple.

Questions

Frequently asked questions

How do your plans and pricing work?

Whatever suits you: a fixed contract, a monthly retainer, prepaid blocks of hours, or simple hourly rates. You pick the model that fits your business, and we keep it transparent with no surprise bills.

How quickly do you respond?

Fast. You talk to a real person, not a call queue. For urgent issues we're often on-site within the hour across Adelaide, with remote support Australia-wide.

Do you only do IT support?

No. IT & Digital, cyber security, websites & hosting, business solutions and currency equipment, all from one local team. One number to call.

What does it cost?

Managed IT is typically $80 to $200 per user per month. One-off help is $115 an hour remote or $180 an hour on site. Prices are ex GST. See our rates.

Do you support businesses outside Adelaide?

Yes. We're Adelaide-based with on-site visits across South Australia, remote support Australia-wide, and we fly in to clients in Darwin, Brisbane and elsewhere for planned work.

Will you work with our existing IT person?

Absolutely. We often co-manage, taking on monitoring, security and after-hours cover alongside your in-house team.

Why we're different

Not your typical IT company

We keep it simple, and fix things so they stay fixed, instead of patching them today.

A typical IT company
WaTo Consulting
You wait in a call queue
A real person on the WaTo team answers
One rigid plan, take it or leave it
Contract, retainer, blocks or hourly: your choice
Patch it today, deal with it again later
Fix the root cause, and what it could cause next
Jargon and over-engineering
Kept simple and explained in plain English
IT only, you juggle other vendors
IT, cyber, web, business & currency under one roof
Hosting resold from someone else
Our own Australian hosting, run by us
WaTo character, happy to help

Still not sure what you need?

Tell us what's slowing you down and we'll point you to the right fix. You're a partner, not a client.

Call (08) 7123 0805 Email info@wato.com.au
Why clients choose us

Trusted by Adelaide business since 2001

The WaTo team
Real people in Adelaide, not a call queue
  1. SA Construct · client from day one
    Our whole IT structure is with WaTo Consulting for the simple reason that there's no sales spiel, no waiting in line on the phone, and always an effective, quick result when needed.
  2. Wato

    From day one and still going 🤝

  3. Enzo's at Home · client since 2001
    WaTo has been assisting our company since 2001. Always punctual, trustworthy, honest, and can be relied on to get the job done.
  4. Wato

    Time flies when you're having fun 🙌

  5. Real estate business · client from 2010
    WaTo looked after IT for our property management business from 2010. We grew dramatically in that time and WaTo was instrumental in keeping all our IT in order, with smooth upgrades.
  6. Alyx

    Loved being part of the growth 📈

  7. Hospitality venue
    In a busy, large hospitality venue with constant IT issues, WaTo is an incredible asset. If WaTo's called with an issue, they're often here within the hour.
  8. Lee

    On my way 🚗

  9. Accounting practice
    WaTo has been invaluable in moving us from Outlook to Gmail and teaching us the other Google products. Friendly, approachable and easily understood. We've even brought WaTo in to help one of our own clients migrate.
  10. Lee

    Happy to help your clients too 🤝

  11. CRS · client since 2011
    Our data is the backbone of our company, and we sleep easy at night knowing it's safe and secure. Whenever we have an IT problem, WaTo understands how crippling downtime is and is quick to act.
  12. Alyx

    Backups checked. Sleep easy 😴

  13. Lasers in Medicine
    WaTo's IT expertise streamlined our medical practice, reduced operating costs and simplified our backups. 100% quality customer service to small business.
  14. Wato

    Small business is our thing 💪

  15. Engineering company
    Wato, or "DJ WaTo" as he's known to us, has become like family. He always goes above and beyond, with a few good solutions to our ever-demanding needs.
  16. Wato

    🎧 DJ WaTo, at your service

  17. City cafe, multiple locations
    WaTo set up our point of sale and internet. They always answered my calls and could even troubleshoot problems over the phone. Very professional. Thank you, WaTo!
  18. Lee

    Always happy to pick up 📞

  19. Printing industry · client since 2013
    Our business relies on discipline and attention to detail, which is exactly why we've relied on WaTo since 2013. Their knowledge and personal attention give us peace of mind in every area of our operation.
  20. Alyx

    Detail is our thing too 🔍

  21. Genmed 480
    We feel extremely lucky to have WaTo look after our computers. Easy to talk with, explains things in plain terms instead of jargon, and never pushes us to upgrade to the latest and greatest.
  22. Lee

    No jargon, promise 🙂

  23. Alex, 30 Acres · client since 2021
    If you're anything like us, IT is very daunting! WaTo took away the hassle and stress of setting up our brand new restaurant and installed our point of sale. Timely, efficient and a reasonable price. Highly recommended!
  24. Wato

    30 Acres, still the freshest food ever! 🍽️

  25. AV industry
    WaTo delivers for our standard office admin and as a consultant for integrating audio, visual and lighting products into the IT world. Problems are dealt with swiftly to avoid downtime.
  26. Lee

    Lights, camera, uptime 🎬

  27. Cummins Allison (CPI) · client since 2014
    Their ability to grasp and apply product-specific technical process has allowed us to meet all customer KPIs and offer value-added services.
  28. Alyx

    KPIs met. Keep counting 💵

  29. Allied health practice
    When the medical diary crashes, that's an all-out emergency. It happened three times in one year, and each time WaTo fixed it in under 10 minutes. Personal, reliable and fast.
  30. Alyx

    Diary's back up ✅

  31. Sports industry · client since 2015
    We've used WaTo since 2015. Before that, other providers made things difficult. WaTo is prompt, upfront and very reliable, and has saved us heaps!
  32. Lee

    Glad we could save you heaps 💸

  33. Sole owner-operator
    WaTo moved my site to a new server and set up secure, reliable email and hosting, so I could get on with what I do best. I'd send anyone to WaTo for all their wizardry needs.
  34. Wato

    Wizardry on tap 🪄

  35. Recreation industry
    WaTo did an amazing job setting up the audio and visual in our new business, and fantastic work migrating email accounts and managing our domains. Service is A+.
  36. Lee

    A+ right back at you ⭐

  37. Small home business
    Doesn't matter how small your business is, we all need help with IT and digital. WaTo makes me feel like BIG business.
  38. Alyx

    Small business, big support 🚀

  39. Mike Roberts
    As a non-geek, I appreciate that WaTo's always got my back and never makes me feel I'm imposing when I ring out of hours. Looking for someone local and reliable? WaTo's who you call!
  40. Wato

    Anytime, Mike 👍

Who we work with

Our story

Built in Adelaide, since 2001

WaTo Consulting was founded by John Watson in Adelaide in 2001. Over two decades it's earned a name for tailored work across a wide range of industries, helping businesses of every size run more smoothly, work more efficiently and grow steadily, without blowing the budget or disrupting the day-to-day. Rumour has it the story starts much earlier, with a young Wato on his grandfather's knee in front of a Commodore 64, learning to code in BASIC.

Emma Watson (née Dickenson) was part of the story for a stage along the way. She brought real estate and property management expertise, and a clear view of where the business could go: growing it, bringing in new systems and fresh thinking, and lifting the standard of how things are done. WaTo has been through plenty of shapes and stages since, but one thing she helped sharpen has never changed: being consistent for the client is a must.

Today it's all tailored, never off-the-shelf: IT & Digital, Business & Web Hosting, built around what each client actually needs. Over the years those areas have come together under one roof: our IT & Digital, Currency, Business and Web Hosting work now all sit within WaTo Consulting. One team, one standard, looking after the lot.

When you work with us, you're a partner, not just a client.

Call Us Contact Us Help
Need help?Now?