What could this mean for your business?
For organisations of all sizes, including many small and medium-sized businesses, a website is far more than an online brochure.
It may be where customers make appointments, purchase products, request quotes, submit inquiries or access important services.
A serious security problem affecting that website could interrupt those activities, potentially exposing sensitive information and damaging customer trust.
On 21 October 2026, two critical security flaws were publicly disclosed in PHP, software that operates behind the scenes on a substantial proportion of the world's websites.
The scale is significant. PHP powers millions of websites and online applications, making the discovery a concern for organisations and cybersecurity authorities around the world.
The vulnerabilities are collectively known as PHP2Shell. In some circumstances, attackers could exploit these weaknesses without needing a username or password.
Depending on the website and the systems connected to it, a successful attack could allow attackers to:
- Take control of a website or its supporting server.
- Change website content or interrupt its operation.
- Access sensitive business or customer information.
- Disrupt online orders, appointments or customer inquiries.
- Potentially reach other connected systems.
Using PHP does not automatically mean a website is exposed to these attacks. However, the potential consequences are serious enough that businesses should act quickly rather than assume they are protected.
Why are governments taking this so seriously?
Cybersecurity agencies around the world, including in Australia, the United Kingdom, the United States, and countries across Asia-Pacific and Europe, have issued urgent warnings.
Australia's Australian Cyber Security Centre classified the issue as critical. It advised organisations to identify affected systems, apply security updates and monitor for suspicious activity.
The UK's National Cyber Security Centre urged organisations to take immediate action, including identifying affected systems and installing the necessary security updates.
It went further, recommending that organisations consider taking affected systems offline if the vulnerabilities cannot be promptly addressed or adequately mitigated. The United States National Security Agency issued similar guidance.
That is an unusually serious position, particularly for organisations that depend on their websites for customer services, communications or revenue.
Security companies have also reported attempts to exploit the vulnerabilities. Cloudflare, which provides security and performance services for roughly one in four websites worldwide, reported detecting attack traffic and attempts to evade its protections.
The immediate concern is that attackers may target websites that remain unpatched.
Some organisations have already taken websites offline
The disruption is already being felt.
Reuters reported on 21 October that government organisations in several European countries had taken websites offline following the disclosure.
The Wikimedia Foundation, which operates Wikipedia, also confirmed that it had deliberately taken many supporting services offline while security updates were prepared. This did not mean that Wikipedia itself had been shut down.
Importantly, a website being taken offline does not necessarily mean it has been hacked.
An organisation may deliberately suspend a service while investigating potential exposure, applying security updates or putting additional protections in place.
For businesses, however, the consequences of even a precautionary shutdown can be significant.
Imagine a professional services firm temporarily unable to receive online appointment requests, or a retailer whose online checkout must be suspended during a busy trading period.
Neither scenario necessarily involves stolen information or a successful cyberattack. Yet both can mean lost business, additional work and frustrated customers.
Could your website be affected even if it was recently updated?
Yes. This is one of the most important points for business owners to understand.
Many businesses rely on someone else to maintain their website. They may receive regular notifications that WordPress, a plugin or another website application has been updated.
That is good practice, but it does not automatically mean everything supporting the website has been updated.
Think of a website as a business premises.
You might have recently serviced the doors, updated the alarm system and repaired the locks. But if there is a serious problem with the building's underlying structure, those improvements do not address it.
Websites have similar layers of technology.
WordPress, used by roughly 40% of websites worldwide, is a familiar example of software used to manage website content and features. PHP is software that WordPress relies on behind the scenes to process information and respond to visitors.
The newly disclosed vulnerabilities affect PHP itself.
That means a website may have the latest version of WordPress and still be exposed if the version of PHP running behind it has not received the necessary security fix.
The same principle applies to websites and applications built with other common website management and commerce systems, including Drupal, Joomla, Magento (Adobe Commerce) and MediaWiki. Some custom-built business applications and online portals also use PHP.
This does not mean every website using these platforms is vulnerable. Whether a particular website is exposed depends on the software it uses, how it is configured and the security updates already applied.
Some hosting providers and technology vendors may already have installed the necessary fixes without their customers needing to take direct action.
But businesses should obtain confirmation rather than assume this has happened.
How did AI help uncover these vulnerabilities?
Artificial intelligence played a significant role in discovering and investigating the weaknesses.
Researchers at Wiz, a cybersecurity company owned by Google, used advanced AI systems including Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.
GPT-5.6 Sol is part of the same family of AI technology behind ChatGPT. Researchers used these AI capabilities alongside their own expertise to investigate security weaknesses and develop ways to test them.
Wiz reported that AI helped its researchers find security weaknesses, develop and test ways they could be exploited, and verify that fixes worked.
Researchers at Calif also used GPT-5.6 Sol to help identify a critical PHP flaw through OpenAI's Patch the Planet initiative. Their findings and Wiz's independent research were part of the coordinated disclosure and remediation effort.
The work involved skilled human researchers, software maintainers and security organisations working together.
What makes the discovery particularly significant is that the underlying weaknesses had existed for years, while demonstrating how they could be exploited was exceptionally difficult.
AI helped researchers carry out complex analysis and testing that would previously have demanded considerable specialist effort.
For businesses, that development presents both opportunities and risks.
Security professionals can potentially identify dangerous weaknesses sooner and help organisations protect themselves. But similar advances may also make it easier for cybercriminals to develop or adapt attacks.
It is another reason why organisations need to understand AI's implications beyond everyday productivity tools.
What should your business do today?
The first step is straightforward: contact whoever manages your website and ask them to confirm whether PHP2Shell affects it.
That might be your website developer, hosting company, managed IT provider or internal technology team.
You do not need to understand the technical details or attempt to fix the problem yourself.
You do need to know who is responsible and whether appropriate action has been taken.
Ask your provider to check for PHP2Shell, the name given to CVE-2026-109618 and CVE-2026-109619.
What confirmation should you expect?
Your provider should be able to tell you:
- Whether your website or related online services are affected.
- Whether the necessary security fixes have been applied.
- Whether anything remains outstanding or requires further investigation.
A response that simply says "WordPress is up to date" does not fully answer the question.
If your business operates several websites, customer portals or online applications, ensure your provider considers those services too.
For many businesses, this check will be handled entirely by their hosting or technology provider. The important thing is to check and ensure you get a clear answer.
What if your provider cannot fix the problem immediately?
For some websites, the necessary security updates can be installed quickly.
Others may depend on older software, specialist applications or technology managed by different suppliers.
Where a fix cannot be applied immediately, your provider should explain the risks and what protections are available.
Temporary security measures may help reduce the danger, but they should not be treated as a permanent replacement for the necessary updates.
For a particularly exposed website or online service, temporarily taking it offline may need to be considered.
This is not merely a theoretical recommendation. Governments and other organisations have already taken websites and online services offline as a precaution while addressing the vulnerabilities.
The decision should be based on advice from the responsible technical professionals and an assessment of the business consequences.
A website displaying general business information may present different risks from a customer portal holding personal records or an online store processing transactions.
The important thing is to make an informed decision rather than leave a known risk unresolved.
What if your website has already been attacked?
A website appearing to work normally does not necessarily mean it is secure.
If your provider identifies suspicious activity or evidence that attackers may have gained access, further investigation may be necessary.
Installing a security update fixes the underlying weakness, but it does not automatically resolve any damage or unauthorised access that may already have occurred.
Your provider should advise whether specialist cybersecurity assistance is needed.
Practical takeaway
If your business has a website, ask the people responsible for maintaining it whether these newly discovered security flaws affect you.
Even if your website has recently been updated, it may need additional protection. If everything is secure, ask your provider to confirm that. If work is needed, find out what is being done, who is responsible and when it will be completed.
The broader lesson is that serious security problems can affect any organisation that relies on digital services, often through technology its owners and managers never see.
Matthew Tati is co-founder of AI Body of Knowledge, which helps organisations build practical AI capability and use AI safely and effectively. His background includes managing product development and engineering at Oovvuu, an Australian AI-powered video technology company that was a WordPress VIP Featured Technology Partner in 2020.
AI security beyond website vulnerabilities
AI Body of Knowledge helps organisations understand and manage the opportunities and risks associated with AI.
Our AI Security Check reviews how organisations use AI, including information exposure, permissions, governance and safe working practices.
For help understanding and managing AI security within your organisation, contact AI Body of Knowledge.
Sources and further reading
- Australian Cyber Security Centre — critical PHP alert
- US National Security Agency — critical PHP patch advisory
- UK National Cyber Security Centre — PHP security warning
- Malaysia National Cyber Security Agency — PHP advisory
- Wiz Research — PHP2Shell discovery
- OpenAI — coordinated vulnerability disclosure
- Cloudflare — PHP protections
- BBC News — PHP2Shell website disruption reporting
- Oovvuu — WordPress VIP Featured Technology Partner announcement
- PHP project — official security advisory