Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) in Simple Terms
Published 22 October 2026 by James Alviani
Overview
- Two critical flaws in PHP, the language that runs about 70% of websites (including every WordPress site), let hackers take over a website without logging in.
- Details leaked before the fix was ready, which is why some large organisations took their websites offline.
- The sites we host on SiteGround were protected before the fix was released, and every live site on our Servers Australia server is now on patched PHP.
- My theory is that AI is speeding up how fast security holes are found and used.
- This year we cleaned up two major malware attacks on sites that weren’t on the Halo system. Both most likely got in through a plugin with a known security hole.
I don’t recall a more publicised vulnerability than the critical PHP vulnerability that has been flagged today.
Many large companies have taken the extreme step of shutting down their servers (taking their websites offline) to mitigate any potential hacking attempts on their sites.
What is going on? Here it is in simple terms.
What the Vulnerability Is
PHP is the programming language behind about 70% of the world’s websites. Every WordPress site runs on it.
Two flaws have been found in PHP itself. They’ve been nicknamed PHP2Shell (officially CVE-2026-109618 and CVE-2026-109619) and are rated 9.2 out of 10 for severity.
Put simply, they let a hacker run their own code on the server behind a website. No password or login needed. Once they can do that, they can do pretty much anything to the site, from planting malware to stealing data.
The fix came out on 21 October, but the details leaked online before it was ready. PHP also only fixes its newer versions (8.2 and up). Sites running older versions don’t get an official update at all.
What We’ve Done About It
We host our clients’ websites on SiteGround, plus an older Servers Australia server we’re in the process of moving off.
SiteGround
SiteGround moved early. Before the fix was even released, they rolled out protections across all their servers that switch off the parts of PHP these flaws use. If your site is hosted with us on SiteGround, there’s nothing you need to do.
Servers Australia
On 21 October we moved every live site on this server off older versions of PHP and onto PHP 8.3 or 8.2, the versions that get the official fix. The patched PHP was installed on the server the next morning and we checked every site again afterwards. All are loading normally. The sites still on this server are being moved to SiteGround.
Why Such Widespread Concern?
Partly it’s the size of it. When around 70% of websites run on the same software, a hole in that software is a hole in most of the internet.
The leak made it worse. Hackers had the details at the same time as everyone else, before most servers could be patched. Some security firms reported attacks within a day.
My theory is that AI is empowering bad actors. The security firms that found these flaws used AI models in their research. This time the good guys got there first. But the same tools are available to anyone. AI can read through code and spot weak points far faster than a person can, and it can help write the attack too.
The gap between a hole being found and a hole being used is shrinking. So big organisations would rather go offline for a while than take the risk.
What We’ve Found This Year
This year we’ve dealt with two major malware attacks. Neither site was on the Halo system, and both needed a full clean-up.
The First Site (June)
The host flagged it as a traffic attack. When we logged in, it was clear the site had been hacked. The hackers had added a program to the site that, if a visitor followed its steps, would have given the hackers control of the visitor’s computer. Behind the scenes there were fake plugin folders and hidden admin accounts, and some of the bad files were dressed up to look like normal WordPress files.
What we did:
- Took the site offline with a maintenance page
- Rolled it back to a clean backup from before the attack
- Removed everything the hackers had added
- Reinstalled WordPress’s core files fresh
- Reset every password and turned on two-step login
- Updated everything on the site
- Ran a full malware scan, then moved the site to SiteGround
The Second Site (September)
The hackers planted hidden tools that let them control the site from outside, then wiped almost all of its files. The website simply disappeared. Worse, the server it was on had no working backups.
What we did:
- Restored the entire server to the day before the attack to get the site back
- Reset every password and turned on two-step login
- Removed plugins it didn’t need
- Set up proper off-site backups
- Moved the site to SiteGround
We later traced the likely way in. It was a plugin with a known security hole that let anyone install their own plugin on the site, no login needed. That plugin is gone.
Neither attack needed anything as big as PHP2Shell. Both most likely got in through a plugin with a known security hole. And the second one is a good reminder to check your backups actually work before you need them.
If your website isn’t with us, it’s worth asking your host or developer which version of PHP your site runs on and whether the fix has been applied. Happy to have a chat if you need some help.
Ready to get found for what you do?
Start with a free assessment of your website and marketing. We’ll tell you where you stand and what it would take to become the business your area finds and trusts. No obligation.
Get a free assessment