PHP security warning: what Tech TroubleShooters has done, and three questions to ask your web host
Good maintenance is the kind nobody notices. Nobody sends a thank you card because the roof didn’t leak.
Websites work the same way. When the updates get done quietly in the background, nothing happens, and nothing happening is exactly the point. It’s a bit like getting the roof checked before cyclone season in North Queensland: the reward is a storm that comes and goes without any drama.
As at 22 October, we’ve applied this week’s PHP security fixes to the websites hosted and managed by Tech TroubleShooters. Our clients didn’t have to do a thing. Has yours been patched?
We’re keeping an eye out for further updates.
What happened with PHP this week
Here are the facts as at 22 October, in plain words.
The Australian Cyber Security Centre (ACSC) has issued an alert about serious security flaws in PHP, the software that ABC News reports underpins large parts of the internet, including WordPress sites.
The PHP project says the flaws can let an attacker run their own code on a web server without logging in, and that every PHP installation that serves web pages is at risk until it’s updated. (PHP project security advisory)
ABC News reports hackers are believed to be exploiting the flaws. At the time of its alert, ACSC said it wasn’t aware of active exploitation. ABC also reports that cyber.gov.au, the government’s own cyber security site, was among the Australian government websites affected.
Source: ABC News, 22 October 2026
Does this affect my website?
It might, and it’s worth finding out today. PHP is the software running behind the scenes on a lot of websites. You won’t see it on the page, but your web server uses it to build pages when people visit.
The simplest way to tell:
- Is your site built with WordPress? If so, it runs on PHP.
- Not sure what your site is built with? Ask whoever built it or hosts it. It’s a quick question for them.
If you run WordPress, you might be wondering whether you need to update WordPress itself. WordPress.org says no WordPress update is needed, because the flaws aren’t specific to WordPress; the fix is to PHP on the server. (WordPress.org: Critical PHP Security Release)
That means the fix sits with whoever looks after your server, which is usually your web host or IT provider.
Three things to ask your web host
Copy these into an email or have them handy when you ring:
-
Has PHP on my website’s server been updated to a fixed version? This is the one thing to do today.
-
When was it updated? A date gives you something firm to note down, rather than a “should be fine”.
-
Who is keeping an eye out for further updates, and will you let me know when they’re applied?
If the answers are vague, or nobody is quite sure who looks after the server, that’s a sign it’s worth sorting out.
What updating does and doesn’t do
Updating closes these holes, but it won’t clean up a server that’s already been broken into.
Think of it like changing the locks. New locks stop the next person getting in with the old key, but they don’t tell you whether someone has already been through the house. If you have any doubts about your site, raise them with your web host or IT provider when you ask the three questions above.
Want someone to look after it for you?
We applied this week’s fixes to the websites hosted and managed by Tech TroubleShooters, and our clients didn’t have to do a thing. That’s the whole idea of web hosting and ongoing website maintenance: the updates get looked after, and you get on with running your business.
Is your website hosted somewhere else? If you’d like someone keeping it regularly updated for you, tell us what’s bugging you and we’ll tell you what’s involved. Contact us, email contact@techtroubleshooters.com.au, or call Carisa on 0448 017 919 or Kelly on 0429 727 091.