1. Resources
  2. Security advisories
  3. HTW-HC-SA-2026-001
Security advisory HTW-HC-SA-2026-001

Critical PHP vulnerabilities (php2shell)

Severity: CriticalStatus: Resolved
First reported
20 Oct 2026
Last updated
22 Oct 2026, 3:44pm AEDT
Applies to
Website hosting
  1. InvestigatingAssessing exposure
  2. MitigatedProtections in place
  3. PatchedSecurity update applied
  4. ResolvedPatched and verified

Current status

Resolved. The security update has been applied to all our hosting servers, and a final check of every website and server found no signs of compromise. Websites, forms and online stores are working normally. No action is needed.

Affected services

Service Status Details
Website hostingAll hosted websites Resolved Security update applied to all servers and every website checked. No signs of compromise.
Website forms and uploadsSome hosted websites Restored A temporary restriction blocked some file uploads and form submissions, including adding items to a cart on some online stores. It was lifted at 2:44pm on 22 October and these are working normally again.

What happened

On 20 October 2026, details of two critical security vulnerabilities in PHP were leaked publicly before a fix was available. PHP is the technology behind most websites, including all WordPress sites. The vulnerabilities could allow an attacker to take control of an affected web server. PHP released a fix on 21 October, and hosting providers worldwide are now rolling it out.

What this means for you

If we host your website, it runs on PHP and is affected until the update is applied to our hosting servers. This does not mean your website is unsafe to use. It means it is exposed to this specific issue, which we are actively monitoring for and which will be patched as soon as the update is available.

What we have done

  • Checked every website we host for signs of compromise since 20 October. None were found.
  • Confirmed protective measures are in place on our hosting servers to block known attack methods.
  • Put additional monitoring in place, with frequent automated checks of every hosted website.

What happens next

The update has been applied and every website checked. This advisory is now closed and will stay here as a record.

Do I need to do anything?

No action needed.

If anything changes that affects your website, we will contact you directly.

Update log

  1. Resolved Resolved

    Final check of every hosted website and server completed with no signs of compromise. The security update is in place on all our hosting servers. This advisory is now closed.

  2. Security update applied Patched

    The security update has been applied to all our hosting servers. Final checks of every website and server are under way.

  3. Upload and form restriction lifted Restored

    Our hosting provider lifted the temporary restriction. File uploads, form submissions and online store carts are working normally again. The full PHP security update is still being rolled out.

  4. Upload and form issue identified Disrupted

    The temporary protection on our hosting servers is blocking some file uploads and form submissions, including adding items to a cart on some online stores. We are working with our hosting provider to resolve this and helping affected clients directly.

  5. Monitoring Monitoring

    All hosted websites checked with no signs of compromise. Additional monitoring in place until the full update is applied.

  6. Protections applied Mitigated

    PHP released the fix. Protective settings applied across our hosting servers while the update is prepared.

  7. Investigating Investigating

    Vulnerability details became public. We began assessing exposure across all hosted services.

← All security advisories