Updated: 22 October 2026, 06:21 AEDT Australian website operators are being urged to check and update PHP after two critical software vulnerabilities triggered an international security response on Wednesday, 21 October. ABC reported that the Australian Signals Directorate said cyber.gov.au and other Australian government websites had experienced outages in connection with the issue. The US Cybersecurity and Infrastructure Security Agency’s 21 October alert says the flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known as “php2shell”, can let an attacker run code remotely without authenticating. It says PHP installations serving web requests are affected. CISA identifies PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the updated versions that fix the vulnerabilities. It urges organisations to inventory their PHP systems and prioritise patching those exposed to the internet. For systems that cannot be updated immediately, including unsupported PHP 8.1 or earlier versions, the agenc...