What happened
Two sets of urgent security fixes came out last week, and both affect equipment many small businesses rely on.
On 21 October 2026, the PHP project released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which some researchers have nicknamed “PHP2Shell”. PHP is the software that runs most websites, including those built on WordPress, Drupal and Joomla. The flaws can let an attacker take over a web server by sending it specially crafted requests, without logging in. The Australian Cyber Security Centre (ACSC) issued a critical alert, and Amazon’s security team reports the flaws are now being widely targeted, although it’s not yet clear how many attacks are succeeding.
On 22 October 2026, Fortinet released critical and high-severity fixes for FortiOS, the software on FortiGate firewalls, and for FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. The ACSC issued a critical alert the next day. Fortinet hasn’t published full details yet (they’re due on 10 November) and the ACSC isn’t aware of attacks in Australia so far. Fortinet warns, though, that attackers can now study a fix and build an attack within hours or days.
Does it affect you?
If your business has a website, it very likely runs on PHP. Updating WordPress, themes or plugins won’t fix this; the PHP version on the hosting server has to be updated. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older no longer get official fixes.
If your office uses a Fortinet firewall (often a FortiGate), it needs the new firmware, especially if it can be managed or reached over the internet.
What we’re doing and what you can do
If you’re a managed client: we’ll check whether any Fortinet devices we look after need the update, and we’ll contact you if your firewall or website hosting needs attention.
For everyone:
- Ask your web host or website developer to confirm your site runs one of the fixed PHP versions. In WordPress you can see it under Tools > Site Health > Info > Server.
- If your site is on PHP 8.1 or older, plan a move to a supported version.
- Update FortiGate and other Fortinet devices to the fixed firmware as soon as you can.
- Until then, don’t leave the firewall’s admin page open to the internet, and use strong passwords with multi-factor authentication for admin accounts.
Not sure what runs your website or firewall? Call us on (1800) 30 22 32 or email helpdesk@alliance-net.com.au.
Sources
- Australian Cyber Security Centre: Critical vulnerabilities in PHP (21 October 2026)
- Australian Cyber Security Centre: Critical vulnerabilities in Fortinet products (23 October 2026)
- PHP: Security advisory: critical remote code execution vulnerabilities, update now (21 October 2026)
- Fortinet: Fortinet releases security hardening release for multiple products
- BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches
- WordPress.org: How to check and update your PHP version