Back Office BeatSubscribe

Published by J9 Systems. What's new in business tech, and what it means for yours.

From the brief of Friday, October 23, 2026 · No. 12

From the daily brief · Software

PHP flaws drew attacks from Oct. 17: confirm your WordPress site is patched this week

If your company website, quote form or booking page runs on WordPress, it runs on PHP, and attacks on two critical PHP flaws began Oct. 17.

By Carter Josephson · · 1 min read

What happened

Amazon Threat Intelligence says its MadPot honeypots caught exploitation attempts against PHP2Shell, two PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619, starting Oct. 17, four days before PHP released patches on Oct. 21. Amazon says upgrading to the fixed PHP versions is the only complete fix; if you cannot patch right away, it suggests blocking multi-part file uploads after testing.

What it means for a 10-to-50-person business

If your website runs on WordPress, it runs on PHP, and so does any quote form, booking form or customer portal built on it. Take a 15-person plumbing company with a WordPress site on $30-a-month shared hosting and a web contractor at an assumed $100 an hour. Managed WordPress hosts usually patch PHP for you. On cheaper shared plans you may have to pick the PHP version yourself in the control panel. Sites stuck on old, unsupported PHP versions may have no patch at all and need a real upgrade, which could run 4 to 10 contractor hours. A hacked site can be defaced, used to send spam, or leak the names and addresses your quote form collects. Agencies that host client sites have the most exposure and should audit every site. Hosted apps such as your field-service or accounting software are the vendor's job to patch.

What to do
Ask your vendor

Email your web host or developer today and get written confirmation that your site runs a PHP version with the Oct. 21 fix for CVE-2026-109618 and CVE-2026-109619, and that they checked logs from Oct. 17.

What it costs
What it costs
Email to host or developer
15 min of your time
Developer patch and test, if host does not handle it
1–2 hrs (≈ $100–$200 at an assumed $100/hr)
Upgrade from an unsupported PHP version, if needed
assume 4–10 hrs (≈ $400–$1,000 at $100/hr)
Malware cleanup after a hack
assume $500–$2,000, plus lost leads while the site is down
Doing nothing
$0 now; exploit attempts began Oct. 17 and proof-of-concept code is public
Sources
aws.amazon.com (primary) · The Verge: PHP, the three little letters wreaking havoc across the web · Wired: Hackers exploited the PHP vulnerabilities days before they were patched · BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches

Questions owners ask

My site is on WordPress but a hosting company runs it. Do I need to do anything?

Ask. Many managed hosts patch PHP themselves, but on shared plans the PHP version is often a setting you or your developer control. Get the version number in writing.

What if my site runs an old PHP version?

The flaws reach back roughly 20 years, and many old PHP versions no longer get updates. If yours is one of them, budget for an upgrade or take the site offline until it is done, as the NSA and the UK's National Cyber Security Centre advised.

Does this affect my field-service or accounting software?

For cloud software you log into, patching is the vendor's job. Your exposure is mainly anything you or a contractor host, such as your website and its forms.

Three to five of these, every weekday morning.

Related