PHP2Shell and WordPress: How to Check If Your Website Is Safe in Australia

Updated 24 October 2026 | Australian cybersecurity guide. A pair of critical vulnerabilities in PHP, the software language behind WordPress and many other websites, has triggered emergency patches and government alerts. The flaws are commonly called PHP2Shell. They are serious because an attacker may be able to execute code on an affected server without first signing in.

For an Australian small business, blogger or online shop, the practical question is not whether PHP sounds technical. It is whether the web server running your site has received the fix. Updating WordPress plugins or changing your admin password is good security hygiene, but neither action patches a vulnerable PHP runtime.

The short answer: check the PHP version your website actually runs, confirm whether your hosting provider has applied the October 2026 security fixes (including any vendor backports), and keep a record of the confirmation. If you cannot establish your patch status, contact the host today. This guide explains how to do that without downloading suspicious “vulnerability scanners” or trying attack code against your own site.

What is PHP2Shell, in plain English?

WordPress is built with PHP. When a visitor opens a page, submits a form or checks out at an online store, the server may execute PHP code to prepare the response. The two recently disclosed problems are in the underlying PHP engine rather than in a particular WordPress plugin.

One flaw, CVE-2026-109618, concerns how PHP handles certain out-of-memory conditions and subsequent cleanup. The other, CVE-2026-109619, concerns internal state from a previous request being reused incorrectly. Under exploitable conditions, those problems can lead to remote code execution — meaning an attacker might cause the server to run instructions it was never meant to run.

That is why the incident has drawn attention beyond WordPress. PHP is also used by other web applications and content-management systems. The PHP project specifically warns that installations serving web requests are at risk across configurations such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, while describing the risk as highest for mod_php. This does not mean every website has been hacked, or that all hosting configurations have the same exploitability.

The Australian Signals Directorate’s Australian Cyber Security Centre issued a critical alert on 21 October, subsequently updated to direct organisations to identify PHP, apply patches and monitor for suspicious activity. The PHP team published the fixed versions on 21 October and issued an additional narrowly scoped advisory on 23 October about session upload progress under an unusual configuration. The PHP project’s notices should remain the primary reference as advice evolves.

Which PHP versions have the October 2026 fixes?

These are the official upstream PHP release numbers, not a universal test for every Linux distribution. Some hosting providers use security-maintained packages with fixes backported into older version numbers. If a host says its PHP 8.2.34 package is protected, ask for the specific vendor advisory or package build demonstrating the backport. Conversely, a dashboard displaying a fixed number is a useful sign but not a substitute for confirming that the active web-serving PHP workers have actually been updated and restarted.

How to check your WordPress PHP version — without installing anything

Step 1: Sign in to WordPress

Open your usual WordPress administration dashboard. Navigate to Tools → Site Health → Info. Expand the Server section and look for the PHP version. On some installations the wording or menu placement may vary, especially when a host customises WordPress administration.

Step 2: Compare it with the patched release

Use the table above. If your version is below the upstream fixed release, it needs investigation. Do not assume that an older number proves exposure: your hosting company may have applied a supported backported patch. Equally, do not assume a recent WordPress version proves PHP is fixed — they are different software layers.

Step 3: Check the hosting control panel

If your host uses cPanel, Plesk or a proprietary dashboard, look for a section such as PHP Selector, MultiPHP Manager, PHP Settings or Runtime. Confirm which PHP version is assigned to the actual domain, not merely the default version advertised by the hosting company. Managed hosting may hide this setting because the provider controls it.

Step 4: Ask whether the web-serving processes were updated

After patching, PHP workers or web services may need restarting to load new code. This is normally the hosting provider’s job on shared hosting. Request written confirmation of the applied fix, the affected domains and whether the web-serving processes were restarted. If the host provides a vendor-specific package build rather than one of the PHP release numbers above, request the advisory that confirms the fix.

Step 5: Verify the site still works

After a legitimate PHP upgrade, test the homepage, search, contact forms, login, image uploads, checkout and other critical functions. Check for new errors in the host’s logs. Take a verified backup before making changes yourself, and keep a rollback plan. A failed checkout can be costly even when a security update succeeds.

A real-world check: what The Tech Boom’s own WordPress connection shows

We used an authenticated WordPress management connection to inspect thetechboom.com on 24 October 2026. The connection reported PHP 8.2.35 and WordPress 7.1.3. PHP 8.2.35 is one of the upstream versions identified by the PHP project as containing the fixes for CVE-2026-109618 and CVE-2026-109619.

This is a useful example of the basic version check readers can perform. It is not a penetration test, malware scan or certification that the entire website is secure. The connection did not independently inspect every server process, validate a hosting-provider backport, assess unrelated plugins or test for historical compromise. We did not send exploit requests or publish server configuration details. Website owners should apply the same distinction to their own checks: a reported patched version is evidence of one important control, not proof of complete security.

What if you use WordPress.com instead of self-hosted WordPress?

The distinction matters. Automattic stated on 21 October that WordPress.com, WordPress VIP, WP Cloud, Pressable, Tumblr and other named Automattic-hosted infrastructure were protected. It said users of those services did not need to apply the PHP update themselves.

But installing the free WordPress software on another company’s server does not make that website a WordPress.com-hosted site. A self-hosted site, including one using Jetpack or a WordPress.com login for connected features, needs confirmation from its actual hosting provider. Check your hosting invoice or domain’s server management dashboard if you are unsure who controls the PHP runtime.

Copy this email to your hosting provider

This message avoids asking a host to disclose sensitive infrastructure details publicly. Send it through your hosting company’s official support portal or verified contact address, not an unsolicited link in an email or social-media post.

What to do if your hosting provider cannot confirm the patch

First, open an urgent support request. Ask the host to escalate to its infrastructure or security team and give you a patch status and expected completion time. If you control a virtual private server or dedicated machine, involve the system administrator who maintains PHP packages and services. Do not blindly switch PHP branches in production without checking application compatibility and having a tested backup.

Second, consider interim protection. Cloudflare says it deployed web application firewall rules for PHP2Shell ahead of public disclosure. A properly configured WAF can reduce exposure to some attack attempts, but it is not a replacement for a fixed PHP runtime. The PHP project’s own advisory is explicit that no temporary mitigation fully resolves the vulnerabilities.

Third, review access and monitoring. Check your host’s security alerts, recent account changes, unexpected new administrator users, unfamiliar scheduled tasks and suspicious files with the help of a qualified administrator. The presence of unusual activity is not proof of PHP2Shell exploitation; equally, the absence of obvious errors does not guarantee a clean server. Preserve relevant logs and seek incident-response assistance if you suspect a compromise.

Fourth, take care with unofficial tools. A web page claiming it can remotely scan any domain for PHP2Shell may be inaccurate or unsafe. The PHP version is often not visible to ordinary visitors, and public HTTP headers are not a reliable way to determine patch status. Prefer authenticated dashboard information, hosting-provider attestations and vendor advisories. Avoid executing downloaded “proof-of-concept” scripts on a live business site.

Should you take your website offline?

Not automatically. The right decision depends on the exposure, the business impact, the hosting environment and how quickly a patch can be applied. The ACSC advises identifying PHP, patching and monitoring. A business operating an unpatched internet-facing service with no feasible protection may need urgent risk-reduction decisions with its host or security adviser. By contrast, Automattic says its protected managed-hosting customers do not need to take their sites offline.

Do not publish a blanket instruction telling every WordPress owner to disable their website. For an online store, a school or a community service, unnecessary downtime can also cause harm. Make the decision based on verified patch status and professional advice, not a dramatic headline.

The extra PHP advisory published on 23 October

There is one detail worth knowing after the main emergency patches. On 23 October, the PHP project published an informational notice recommending that administrators consider setting session.upload_progress.enabled=0 until a later bug-fix release to address an unlikely additional remote-code-execution vector. PHP describes an unusual combination involving session serialization settings changed at runtime and identifies it separately as CVE-2026-115560.

This is not a reason for a nontechnical site owner to paste configuration changes into WordPress. Ask your host or administrator whether the additional advisory applies to your setup. A configuration change can interfere with features if applied without understanding the environment. It also does not replace the main October 21 PHP updates.

Printable PHP2Shell website-owner checklist

Use your browser’s Print function to save or print this checklist. Record the date, the person who completed the check and the hosting provider’s response.

Frequently asked questions

Does updating WordPress fix PHP2Shell?

No. WordPress core, themes and plugins should be maintained, but the two disclosed vulnerabilities are in the PHP runtime. Your hosting provider or server administrator must address PHP itself. Automattic makes the same distinction.

My PHP version looks older. Am I definitely vulnerable?

Not necessarily. Some trusted operating-system vendors backport security fixes without changing the upstream version number. Ask your host for the package version and the relevant vendor advisory. An unexplained old version should not be assumed safe.

Can a WordPress security plugin protect me?

A security plugin may provide useful monitoring or defensive features, but it cannot replace an underlying PHP security update. WAF rules can reduce some exposure, not eliminate every possible path.

Have Australian websites been compromised?

The ACSC’s public alert says it was not aware of successful active exploitation in Australia at the time of its published assessment. That is not a guarantee that no incidents have occurred since. Other researchers and security providers have reported attempted exploitation, but attempted attacks and confirmed compromises are different things. Check current official alerts before making a broad claim.

Should I change my WordPress password?

Use strong unique passwords and multifactor authentication as standard practice. If you suspect account compromise, follow your incident-response process and rotate affected credentials. A password change alone does not fix PHP2Shell because the disclosed vulnerabilities can potentially be exploited without a WordPress login.

Our verdict: the most useful security check is the one you can verify

PHP2Shell is a reminder that a modern-looking website can depend on infrastructure its owner rarely sees. Many small businesses diligently update WordPress posts and plugins but have no idea who maintains the server software beneath them. That gap matters when a critical vulnerability appears.

The good news is that the immediate action is straightforward: establish the actual PHP patch status, get confirmation from the party who manages the runtime, and document the result. Our own version check at The Tech Boom found PHP 8.2.35, matching an official fixed release — useful evidence, but not a substitute for wider security review.

Do not panic, do not trust sensational scanner claims, and do not confuse a current WordPress dashboard with a patched server. Ask the right question: has the PHP environment serving my website actually received the fix?

Official sources and methodology

• PHP project: 21 October emergency security release and 23 October follow-up advisory
• Australian Signals Directorate / Australian Cyber Security Centre: critical PHP alert
• Automattic: WordPress.com and managed hosting protections
• PHP security advisory for CVE-2026-109618
• PHP security advisory for CVE-2026-109619
• Cloudflare: WAF response and limits

Illustrative featured photograph: FlyD / Unsplash. The image is not evidence of an actual attack.

Editorial disclosure: This guide combines official technical advisories with original, practical instructions and an authenticated, read-only version check of The Tech Boom’s own WordPress environment on 24 October 2026. We have not run exploit code, performed a penetration test or independently verified every hosting process. No hosting provider has sponsored this article. Security advice may change as vendors publish updates.

More practical technology guides: How Australians can extend Windows 10 security updates and Our independent AI subscription cost calculator.