Empowering Leading Global Brands
If any one of these applies to any site or application you run, treat it as exposed until we verify it. PHP runs underneath your CMS, so your marketing team or page builder cannot answer this question.
PHP shipped the fixes on 21 October 2026. Official builds below these versions carry the flaw. Hosts often patch without changing the number, so we check the build, not the label.
PHP 8.1 and older are end of life and get no official PHP release for this flaw. That includes PHP 7.4, still common on older WordPress and legacy applications. Some hosts backport a fix, but that only buys time. The lasting fix is an upgrade.
This is the most common answer, and the most dangerous one. WordPress updates will not apply this fix. Your agency may assume the host does it, and your host may assume your agency does. Somebody has to own it, and tonight that can be us.
Ticked even one box, or not sure? That's exactly what the free exposure check is for.
The flaws allow code execution without a login, rated 9.2 of 10. EU cyber agencies told organisations that cannot patch straight away to consider cutting exposed apps off from the internet.
PHP is server software. Updating WordPress core, plugins or themes does not change the PHP version your host runs underneath them.
Security firms saw exploitation attempts before the fixes even shipped. Attackers scan for unpatched servers automatically, around the clock.
We follow the same disciplined process whether you run one WordPress site or a fleet of government platforms. You see evidence at every step, and nothing touches production until it passes on staging.
We list every PHP server and app you run.
We apply the official fix or upgrade on staging.
We test, deploy and confirm the live version.
We rotate secrets and set up ongoing patching.
Documentation your board, your auditors and your insurer will actually accept.
PHP 8.1 and everything before it, including the ever-popular 7.4, are end of life. The PHP project ships no official PHP2Shell release for them. An upgrade sounds scary when a decade of plugins and custom code sits on top. That is exactly why we test every upgrade on staging, fix the scope up front and keep engineers on call during cutover.
| Your PHP version | PHP2Shell status | What to do |
|---|---|---|
| 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later | Patched | Verify it's actually live, then harden |
| Host or Linux distribution build (Ubuntu, Debian, Red Hat, cPanel) | Depends on the build | Check the package changelog, not the version number |
| 8.2 to 8.5, below the patched release | Vulnerable | Apply the official fix now |
| 8.2 (any release) | Security support ends 31 Dec 2026 | Patch now, plan the upgrade to 8.3+ |
| 8.1, 8.0, 7.x or older | No official release | Upgrade to PHP 8.3 or newer |
Upgrade once, not twice. PHP 8.2 security support ends on 31 December 2026. If you're moving anyway, we take you straight to PHP 8.3 or newer, so you won't be back here next year.
PHP2Shell won't be the last critical alert. Under an ITCC managed support plan, the next CVE is our 2am problem, not yours. Built for enterprises, councils and agencies running many sites across many platforms.
We track every server, app and version, so "what do we even run?" is never the first question in a crisis.
We apply critical patches in hours, not weeks, with staging tests and verification evidence every time.
We plan version upgrades before end-of-life dates force your hand, so you never migrate in a panic.
We monitor uptime and file integrity, test your backups, and already know your stack when something moves.
We're not a security pop-up that appeared with this headline. ITCC is a Melbourne engineering firm that has built and run PHP platforms for Australian enterprises, councils and brands since 2013. That experience is exactly why we can patch yours without breaking it.
building for Australian organisations since
senior developers across every major stack
projects delivered
Google reviews, 5.0 average rating
The questions CTOs, CIOs and owners have asked us this week.
Our engineers answer 24/7. No scripts, no triage queue.
Call 1300 770 119 Book the free exposure checkPHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on the CVSS scale and could let an attacker run code on a web server without logging in. The PHP project released fixes on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The ACSC issued a critical alert, its highest rating, and government agencies in Australia and overseas took some websites offline while they dealt with the risk.
Assume you're exposed until it's verified if any site or application you run uses PHP below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, runs PHP 8.1 or older, or you're not sure who patches PHP on your server. PHP powers about 70% of websites, including WordPress, Drupal, Joomla and Magento, so most organisations have at least one affected system. Our free exposure check gives you a definite answer, in writing.
No. WordPress auto-updates will not apply this fix. PHP2Shell is a flaw in PHP itself, the language your server runs underneath WordPress, so whoever manages your hosting must apply the patch at server level. Updating WordPress core, themes or plugins, however diligently, does not change your PHP version.
PHP 7.4, like everything up to 8.1, is end of life and gets no official PHP2Shell release. Some hosts and Linux distributions backport a fix, which buys time but leaves you on unsupported software. The lasting answer is an upgrade to PHP 8.3 or newer. PHP 8.2's security support ends on 31 December 2026, so we take you straight past it and you only do this once. We audit every plugin and custom module for compatibility, test the whole thing on staging, and cut over with engineers on call. You'll have a fixed-scope quote before anything starts.
Call 1300 770 119 and you're talking to our team now. Engineers are on call 24/7. Form enquiries get a callback within one business hour. For a typical single site, we can usually complete the inventory the same day and have the patch applied, staging-tested and verified on live in hours rather than weeks. Larger fleets get a prioritised schedule on day one, highest-exposure systems first.
Possibly. Ubuntu, Debian, Red Hat and many managed hosts patch PHP without changing the version number, so a server can show 8.3.6 and still carry the fix. The reverse also happens: a recent version number on a build nobody has updated. We check the actual package build and its security changelog on every server, then confirm the result in writing.
One call starts the clock: callback within one business hour, inventory under way the same day, and documented verification when it's done. Confidential, fixed-scope, Australian.
