Is your website affected by the PHP security flaw?
Two serious flaws in PHP were made public on 21 October. Here is what happened, how to tell if your website uses PHP, and what to do about it.
What happened
On 21 October 2026, the people who make PHP released urgent fixes for two security flaws, now known as PHP2Shell. PHP is the programming language behind a large share of the world’s websites. Under the right conditions, the flaws let an attacker take control of a website or its server without needing a password.
Details leaked before the fix was out, and some government websites overseas were taken offline as a precaution. New Zealand’s National Cyber Security Centre (NCSC) has urged everyone using PHP to update straight away.
Does your website use PHP?
Quite possibly. These popular website systems all run on PHP:
- WordPress, including online shops built with WooCommerce
- Joomla and Drupal
- Magento (Adobe Commerce), PrestaShop and OpenCart online shops
- Moodle, used by many schools and training providers
- Craft CMS and Concrete CMS
- Sites a developer custom-built with Laravel
Other signs: your site was set up on shared web hosting with a control panel such as cPanel, or some of its web addresses end in .php.
If a company hosts your site for you, updating PHP is their job, but it is still worth asking them whether it has been done.
What to do if it does
- Get PHP updated now. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Your host or web developer can do this, and many hosts already have.
- Ask about older versions. If your site runs PHP 8.1 or earlier, those versions no longer get normal updates and need a special fix.
- Ask whether anyone got in first. Updating stops new attacks, but it does not clean up a site that was already broken into.
- If it can’t be fixed quickly, the NCSC suggests taking the site offline until it can be.
Why Kitset sites aren’t affected
Kitset doesn’t use PHP. It is our own website platform, written in JavaScript and run on Google Cloud, so this flaw has nothing to attack on any Kitset site.
A few other things help keep Kitset sites safe. There are no plugins to keep updated. We look after all updates ourselves and test them before they reach your site. Every change is saved, so we can bring back any earlier version. And every site’s secure certificate renews itself.
No website is ever completely risk-free, but you shouldn’t have to follow security news to keep yours running. That’s our job.
Sources
- NCSC encourages immediate patching against PHP vulnerability, National Cyber Security Centre, 22 October 2026
- Today’s PHP security release, The PHP Foundation, 21 October 2026
- Warning for NZ as websites go dark around world in security scare, RNZ, 22 October 2026
- Websites go dark worldwide as AI exposes critical security flaws, NZ Herald