Government alert: check your workshop website for the PHP security flaw

If you’ve got a website for your workshop, this one’s worth two minutes of your time.

On Wednesday 21 October 2026, the Australian Cyber Security Centre (part of the Australian Signals Directorate) put out a critical alert about two serious security flaws in PHP. PHP is the code that runs a huge share of business websites, including every WordPress site. When a government cyber agency tells businesses to act now, it’s not one to ignore.

And this isn’t just an Australian problem. The flaws are in PHP itself, so they affect websites everywhere in the world. Europe’s cyber security agency, CERT-EU, has issued its own advisory telling organisations to prepare to patch immediately (iTnews). Wherever your workshop is, if your website runs on PHP, this applies to you.

What’s the problem?

Two vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619) could let an attacker run their own code on a web server without needing a login. In plain English: somebody could take over your website.

Because the flaws are in PHP, not in a particular plugin or theme, it doesn’t matter how your site was built. If it runs on an unpatched version of PHP, it’s exposed. Security researchers say they’ve confirmed attacks work against WordPress, Drupal, Joomla and Magento sites, and security firms are reporting the flaws are already being exploited (iTnews).

The good news is that PHP has released fixed versions. The fix is simply getting your site onto one of them.

Is Workshop Software affected?

No. To be completely clear, this has nothing to do with Workshop Software. The application is fine and there’s nothing you need to do inside Workshop Software. This is about your business website, which is usually built and hosted separately.

What should you do?

You don’t need to be technical. You just need to make one phone call or send one email.

Contact your web developer or hosting company today. Ask them: “Has my website been updated to a patched version of PHP for the October 2026 PHP security alert?”
Make sure the PHP version is current. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (or later). If your site is on an older version that no longer gets security updates, such as PHP 7 or PHP 8.1, it needs upgrading, not just patching.
Update WordPress, your theme and your plugins while you’re at it. Good habit, and your developer can do it in the same visit.
Keep an eye out for anything odd. Pages you didn’t add, strange redirects, or your host warning you about unusual activity.

If you’re in Australia and think your site has been compromised, the ACSC can be contacted on 1300 CYBER1 (1300 292 371).

Don’t know who looks after your website?

That happens more often than you’d think, especially if the site was built years ago by someone who’s since moved on. Your hosting company is the next best place to start. If you can’t find either, that’s a sign the site isn’t being looked after, and now’s a good time to sort that out.

WorkshopWeb: websites that stay patched

If you’d rather not worry about this stuff at all, have a look at WorkshopWeb, our websites built for workshops. We keep WorkshopWeb sites patched and up to date and get onto security issues like this one quickly, so you can get on with running the workshop.

Quick answers

What is the PHP security alert?

On 21 October 2026 the Australian Cyber Security Centre issued a critical alert about two flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that could let attackers take control of websites running on unpatched PHP. It’s a global issue: because the flaws are in PHP itself, any website running unpatched PHP anywhere in the world is at risk, and Europe’s CERT-EU has issued its own advisory.

Does it affect WordPress websites?

Yes. WordPress runs on PHP, so any WordPress site on an unpatched PHP version is at risk, whatever plugins or theme it uses.

Is Workshop Software affected?

No. Workshop Software is not affected. The alert is about business websites that run on PHP.

How do I fix it?

Ask your web developer or hosting company to update your site to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, and to upgrade it if it’s on an older unsupported version.