Your website's engine just had a very bad week. Here's why smaller businesses should worry most.

Your website's engine just had a very bad week. Here's why smaller businesses should worry most.

Jordan Gall, Head of Cybersecurity, Buchanan Technology

What it is

On 21 October, the PHP Foundation released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10, and neither needs a login to exploit. An attacker can run their own code on your web server without signing in.

PHP is the language behind roughly seven in ten websites. It runs WordPress, Drupal, Joomla and Magento, plus shared hosting platforms and a lot of software that never mentions PHP.

This is not a dodgy plugin or a badly written contact form. The flaw is in the engine itself. Researchers say the problem sits in PHP's own request handling, so a well-maintained application can still be exposed. In one example, an attacker doesn't need to know which site they are hitting or what software it runs. Security researchers also note that PHP processes the malicious request before any application code runs, so your site's own login can't stop it.

PHP's own advice is blunt: "There are no complete mitigations, updating is the only safe choice."

Why you need to care

Large organisations are being hit too. Australian government websites, including the ASD's, reported outages, and agencies in the Netherlands and Finland took sites offline as a precaution. But the same event lands very differently depending on who you are.

You probably won't see it happening. An enterprise has a security operations centre that can isolate a server within minutes. Most small businesses have no 24/7 monitoring, so a web shell can sit quietly for weeks while data leaks out.

Your patching is an afterthought. In a small business, updates often fall to one person who is also running the office, the phones and the printer. Enterprises test and deploy patches through dedicated pipelines. Here, the window stays open until someone gets round to it.

Your site is probably the shop front. SMBs lean heavily on WordPress, Joomla or Drupal with a stack of third-party plugins. Enterprises more often use custom or segmented builds that limit the blast radius. A compromised server can expose passwords, authentication tokens and API keys held in memory.

Your hosting may not be current. PHP only supports versions 8.2 and later, and anything older gets no official fix. Legacy PHP sits forgotten on plenty of small business hosting. You may not even know which version you're running, and many small businesses leave that to a web developer or host who may have moved on.

You can't absorb the hit. A large firm has cash reserves, cyber insurance and legal teams. For a small business, one ransomware event or data breach can mean closing the doors. If your site is flagged for hosting malware, you can lose your main source of customers overnight.

The timing matters too. Cloudflare reported early attacks before the fixes were even released. One security firm warned that mass exploitation would start within minutes of release. Australia's cyber agency said at the time of its advisory that it wasn't aware of confirmed active exploitation, so the picture isn't uniform. That is no reason to wait.

What you can do about it

Think of it as Stop, Think, Do.

1. Find out what you run. Make a list of every website, web app, portal and plugin-based system. Include the old ones nobody uses.

2. Call your hosting provider or web developer today. Ask them one question: "Have you applied the fix for CVE-2026-109618 and CVE-2026-109619, and what PHP version am I on?" The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you don't manage your own server, the update is theirs to apply. If you're on PHP 8.1 or older, ask for a backported fix or a move to a supported version.

3. Patch the runtime, not just the CMS. Updating WordPress alone won't fix an engine-level flaw. The PHP runtime itself must be patched.

4. Don't treat a firewall as the fix. Cloudflare's web application firewall has blocked exploitation attempts by default since 21 October, even on the free plan. But Cloudflare is clear that this sits on top of the fix and doesn't replace it.

5. If you can't patch yet, consider taking it offline. Australian web security expert Troy Hunt's advice was to patch very quickly or take the site offline. A website that's briefly down is far cheaper than one that's compromised.

6. Watch for the warning signs. Unexpected shell processes on the server and memory-exhaustion errors are two of the indicators security researchers point to. If you suspect compromise, isolate the system, preserve the logs and rotate exposed credentials and tokens.

7. Tighten the basics. Use unique passwords or, better, passkeys with a password manager, so a breach at one site doesn't unlock your other accounts.

The bigger lesson is that we can't expect small businesses to out-spend enterprises on security. What we can do is make the basics boring and repeatable: know what you run, know who looks after it, and have someone who can act within hours, not weeks.

If you're not sure whether your website, or your hosting, is covered, get in touch. A short conversation today is a lot cheaper than a clean-up next month.