Key takeaways

• The ACSC rated the alert critical and says all PHP versions from PHP 5 onwards may be affected.
• Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4, 8.0 and 8.1 have no official release, and PHP 7.3 and older have no fix.
• This week: list every site and app, find the PHP, check the version, then patch or isolate what you cannot patch.
• You can only patch what is still supported, so support dates decide how fast you can respond.
• Kentico says its evergreen model ships hotfixes weekly. Support for Kentico Xperience 13 ends on 31 December 2026.

What happened with PHP this week?

On Wednesday 21 October 2026, the ACSC, which is part of the Australian Signals Directorate, published a critical alert on two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10. They can allow unauthenticated remote code execution, which means an attacker could run code on a web server without logging in. The first involves memory corruption when a request runs out of memory. The second involves stale state that a later request on the same worker can abuse. The ACSC says all PHP versions from PHP 5 onwards may be affected.

Researchers at Calif, working with OpenAI and Wiz, found the flaws with help from AI, and the planned disclosure leaked early. By Thursday morning several Australian government websites had been taken offline temporarily while the risk was reduced. Reports differ on exploitation. The ACSC says it is not aware of successful active exploitation within Australia, while security firm watchTowr says it has seen exploitation since 21 October.

Which PHP versions are fixed, and which have no fix?

The PHP project fixed both flaws in its four supported branches. Anything older needs a vendor or long-term-support package, a backport or an upgrade. PHP says no configuration change fully mitigates the flaws, so updating and restarting every PHP worker is the fix.

As at 23 October 2026, from watchTowr's FAQ. Check php.net for the latest releases before you act.

What should you check this week?

The ACSC's advice is to identify PHP in your environment, review PHP's guidance, apply updates and monitor for suspicious activity. In practice that becomes six steps you can finish this week.

1. List every website, app and server you run, including old microsites, staging sites and anything run by an agency or vendor.
2. Find the PHP. WordPress, Drupal, Joomla and Magento all run on PHP, as do many custom builds. If you are unsure, ask your host or agency.
3. Check the version. Ask your host, or run php -v on the server. The command-line version can differ from the one serving your website, so confirm which one handles web requests.
4. Compare it with the table above.
5. Back up first, then patch and restart all PHP workers. If your version has no official fix, move to a supported branch or use a vendor package.
6. Name an owner and a deadline for each system, and monitor for suspicious activity.

If you cannot patch something today, restrict internet access to it until you can. watchTowr advises this for anything you cannot patch straight away, and the ACSC's guidance points the same way.

Why do support dates decide how fast you can fix things?

Patching only works on software that is still supported. End of support means the vendor stops releasing updates, including security fixes, while the software keeps running. That is why the table above has rows that say no fix. A flaw in a supported version gets a patch. The same flaw in an unsupported version stays open.

The same logic applies to your platform. Kentico's support lifecycle page lists 31 December 2026 as the end of technical support for Kentico Xperience 13. Until then, Kentico says releases are limited to security hotfixes. From 1 January 2027, it says all support, updates and security repairs stop. Your site will not switch off, but it will stop receiving fixes. If your site is on Kentico Xperience 13, plan the move to Xperience by Kentico now, while you can still choose the pace.

What does an evergreen platform change?

An evergreen platform ships changes continuously instead of in large versions. Kentico says Xperience by Kentico ships hotfixes weekly and feature refreshes monthly, with a 7-day security bug-fix policy for the latest release. On its SaaS option Kentico handles infrastructure and versioning. On private cloud your team decides when to apply updates, with partner support. Kentico's marketing says you never need to upgrade again, but its own FAQ is more careful: updating means reading the release notes and applying updates when needed.

In our view, the real benefit is that staying current becomes routine, not a project. That is what lets a team respond within days when an alert lands.

Is Kentico affected by these PHP flaws?

No. Both flaws are in the PHP runtime, and Xperience by Kentico runs on .NET, so they are not in its stack. The same goes for Kentico Xperience 13, which is also a .NET product. The checklist above still applies, because PHP can run next to your Kentico site: an old microsite, a blog or a vendor-run tool. If you are not sure what runs where, that is the first thing to find out.

A patch is only as fast as the support behind it. If you want help working out where PHP runs, or planning the move off Kentico Xperience 13, our Xperience by Kentico team can start with what your site does for you today.

About Dapth

Dapth is your Perth digital consultancy, building connected digital systems from websites and intranets to applications, software, ERP and AI tools. For more than 15 years we have helped WA businesses, government agencies and organisations unlock advantages like streamlined workflows, increased efficiency, cost savings, new revenue and more powerful marketing.

We start with your organisation, not the technology: your users, your operations and your objectives. Then we connect everything across four areas:

• Digital Consultancy: Digital strategy, service design and UI and UX design that map how your customers, people and systems should work together, before anything is built.
• Customer Experience: Websites and digital experience platforms on Xperience by Kentico (Kentico Gold Partner), Sitefinity, Umbraco and Payload CMS, plus ecommerce.
• Employee Experience: Intranets and employee portals on Microsoft SharePoint, and workflow automation that takes the double handling out of everyday work.
• Operational Systems: ERP with Odoo as our primary platform (we are an Odoo partner), plus custom software, apps and the integrations that connect them.