The PHP2Shell vulnerability has triggered one of the biggest website security scrambles in years, forcing Australian government sites, education platforms and web hosts offline while operators rush to patch. Two critical flaws in PHP, the programming language behind an estimated seven in 10 websites including WordPress, let attackers run their own code on a vulnerable server without logging in. They were uncovered with the help of artificial intelligence.

The Australian Signals Directorate (ASD) has issued a rare critical alert, and experts say Australians should expect more data breaches. Here is what happened, which PHP versions are patched and what website owners and everyday users should do now.

What is the PHP2Shell vulnerability?

PHP2Shell is the nickname for two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s developers rated the severity at 9.2 out of 10, and the flaws allow unauthenticated remote code execution. In plain terms, an attacker could take control of a vulnerable server, steal user data or install malware without needing a password.

According to ABC News, the flaws have been present for more than a decade. Calif, the security firm that helped find them, said the bug appears in PHP versions released as far back as 2012. The PHP project says there are no complete mitigations, and updating is the only safe choice.

Which PHP versions are patched?

Emergency fixes were released on 21 October. According to Help Net Security, the patched versions are:

• PHP 8.5: update to 8.5.12
• PHP 8.4: update to 8.4.27
• PHP 8.3: update to 8.3.36
• PHP 8.2: update to 8.2.35
• PHP 8.1 and older: no official fix, because these versions are end of life. Some Linux distributions and long-term support vendors offer backported fixes, so check with your vendor or upgrade to a supported release.

The scale of the problem is large. Security firm TuxCare, citing the Mallory scanning service, said roughly 884,000 internet-facing hosts advertise a PHP version that no longer receives upstream security updates.

How AI helped find the flaw

The discovery is a landmark moment for AI in cybersecurity. Calif said it used OpenAI’s models, building on existing research that theorised about a possible attack route, to confirm a legitimate vulnerability. Google-owned Wiz said its research used its own Wiz Atlas tool alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, and that the work would have been difficult to scale before AI.

The PHP Foundation said a developer had spotted early signs of the underlying problem in 2024, but the work repeatedly stalled because of difficult technical choices and limited resources. It said AI helped assess reports, while humans made every decision and wrote every patch. OpenAI warned that the same capabilities that help defenders could help attackers build exploits faster, and the Australian Information Security Association called the episode a wake-up call for Australian organisations.

Australian websites go dark

The ASD’s critical alert was aimed at everyone from government and critical infrastructure to individuals and families. The agency advised organisations to find PHP in their environments, apply security updates and monitor for suspicious activity, and said cyber.gov.au and other Australian government websites reported outages. Cybersecurity agencies in Europe, Japan and Britain issued similar warnings, urging users to update immediately or take websites offline until patches are applied.

The disruption spread quickly, according to the ABC:

• GovCMS, which hosts many Australian government websites, blocked direct access to its servers while keeping cached copies of public pages available.
• Moodle, the education technology company whose software powers learning platforms at universities and schools, took its website offline before restoring it after applying fixes.
• VentraIP, an Australian hosting provider, restricted some file uploads on customer hosting, warning that forms accepting attachments could fail.
• Smaller operators, including an Australian computer hardware forum, also went offline as a precaution.

Attacks are already under way

Amazon Web Services said it saw an attempt to exploit the flaw as early as 17 October, before it was publicly disclosed. Cloudflare chief executive Matthew Prince said the company recorded millions of exploitation attempts after public disclosure. Australian web security expert Troy Hunt told ABC News Breakfast that operators must patch very quickly or take systems offline, and that Australians should expect elevated data breaches on top of those already seen every day.

What website owners should do now

• Check your PHP version: Look in your hosting control panel, run the version command on your server, or open the Info tab under Tools and Site Health in WordPress.
• Update to a patched release: If you manage your own server, move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On shared or managed hosting, ask your provider to confirm in writing that your site runs a patched build.
• Leave unsupported versions behind: PHP 8.1 and older will not get official fixes, so plan an upgrade.
• Consider limiting access if you cannot patch quickly: Experts, including Hunt, said taking a service offline is an acceptable stopgap.
• Keep everything else current: Update WordPress core, themes and plugins, and watch your logs for unusual activity.
• Back up safely: Keep a recent backup stored away from your web server.

WordPress itself is not the source of the flaw. It runs on PHP, so the fix has to be applied at the server level.

What everyday users should do

There is little individuals can do about servers they do not control, but the ABC reported basic habits that help:

• Use unique passwords, or better, passkeys with a password manager, so a breach at one site does not unlock others.
• Check your card statements over the coming weeks.
• Be wary of unexpected login prompts or download requests, even on sites you trust.

For more on how criminals and state-linked actors exploit online trust, read our report on alleged Chinese spies using LinkedIn.

Frequently asked questions

Is WordPress affected by PHP2Shell?

The flaws are in PHP, not in WordPress. Because WordPress runs on PHP, sites hosted on unpatched servers are exposed until the server’s PHP is updated.

Can I protect my site without updating PHP?

The PHP project says there are no complete mitigations and that updating is the only safe choice.

Should I change my passwords?

Not automatically. Change them if a service you use confirms a breach, and use unique passwords or passkeys everywhere.

Where can I find official guidance?

See the ASD’s alert on cyber.gov.au and the PHP project’s security advisory at php.net.

Image: Derrick Coetzee from Berkeley, CA, USA / Wikimedia Commons / CC0 (cropped and resized)