What is PHP and what does it mean for your business?

You may have seen PHP mentioned in the news recently, following the discovery of security flaws affecting some websites. So, what is PHP, why is it making headlines, and what does it mean for you and your business? Here's a simple breakdown of the issue and a few practical steps you can take to stay cyber safe.

What is PHP?

It stands for Hypertext Preprocessor, an open-source, server-side scripting language designed specifically for web development.

In simple terms, PHP is a type of computer language used to build and run websites. Think of it like the engine of a car. You may not see it working, but it helps everything run as it should.

Originally created in 1994, it serves as the invisible backbone of the internet, powering roughly 70% to 75% of all websites globally.

So, what is the issue?

In August 2026, cybersecurity researchers used advanced AI models to help uncover two serious security flaws in PHP.

The flaws, nicknamed PHP2Shell, had been hiding in the code for more than a decade. They could allow hackers to access vulnerable web servers without needing a password and potentially run malicious code or access sensitive information.

The issue became urgent in October, when details of the flaws leaked before the planned release of a fix. On 21 October 2026, emergency security updates were released to help close these security gaps.

Why is this important now?

Once the PHP security flaws became known, the race was on to fix them before hackers could take advantage.

The Good Guys: Developers released emergency security updates on 21 October 2026 to fix the flaws and help keep websites safe.

The Bad Guys: Hackers can look for websites that haven't installed the fixes and try to exploit the weaknesses to gain access.

Why the rush? The longer an affected website goes without the necessary update, the longer it may remain vulnerable to attack.

For businesses, this is a reminder that keeping your website up to date is an important part of managing cyber risk.

What does this mean for you?

For most everyday internet users, there’s no need to panic. The PHP2Shell issue affects the technology running websites behind the scenes, rather than your computer or phone directly.

However, if a website you use is compromised, there could be a risk to the information you've shared with it. As always, avoid suspicious links, use strong, unique passwords and enable multi-factor authentication where available.

If you own a website

If your business has a website, it's worth checking that it isn't running a vulnerable version of PHP.

1. Contact your website provider

If a web developer or hosting company manages your website, ask them to check whether your site is affected by the PHP2Shell vulnerabilities and whether the relevant security patches have been applied.

A patch is like a digital band-aid for software. A quick update issued by a tech company to fix a mistake, block a security loophole, or repair a bug in a program you already use.

2. Update your website

Make sure your website software, plugins and themes are up to date. If you use WordPress, remember that updating WordPress alone may not fix the PHP issue. Your hosting provider or developer should check the PHP version running on your server.

3. Back up your website

Keep a recent backup of your website and important business information. This can help you recover if something goes wrong.

4. Check your security

Use strong passwords, enable multi-factor authentication where available, and limit who has access to your website's administration tools.

5. Consider your cyber insurance options

Even with security measures in place, cyber incidents can still happen. Cyber insurance may help cover certain costs associated with data breaches, cyber extortion, or business interruption.

While keeping your website secure is an important first step, cyber insurance may also form part of your broader approach to managing cyber risk.

Staying Cyber Safe

The PHP security issue is a reminder that cyber security is important for everyone, from everyday internet users to businesses. Keeping software up to date, using strong passwords and taking steps to secure your information can help reduce your risk.

However, cyber incidents can still happen, even when precautions are in place. Cyber insurance may help cover certain costs if your business experiences a covered cyber incident.

Learn more about our cyber insurance policy and how it may help your business manage cyber risks.

FAQs

PHP2Shell refers to security vulnerabilities discovered in PHP, a programming language used to run many websites. These flaws could allow hackers to access vulnerable web servers and potentially run malicious code.
If you own a website, contact your web developer or hosting provider to check whether your website is running an affected version of PHP and whether the relevant security updates have been applied.
You can’t prevent every cyber threat, but you can take steps to prepare. Learn more about cyber insurance and the options available for your business at insurance.com.au.

This article has been prepared by insurance.com.au Pty Ltd (insurance.com.au) ABN 27 163 909 073, an Authorised Representative (AR Number 443422) of Community Broker Network Pty Ltd ABN 60 096 916 184 AFSL 233750.

The information in this article is of a general nature and does not take into account your individual objectives, financial situation or needs. Before making a decision based on any of the information, you should consider whether it is appropriate to your particular circumstances. You should also obtain and consider the Product Disclosure Statement (PDS) and, where available, Target Market Determination (TMD) before making any decision to acquire a financial product. These are available at https://www.insurance.com.au/important-documents.

The information is current at the time of publication. While every effort has been made to verify the accuracy of the information, insurance.com.au, its officers, representatives, employees and agents disclaim all liability (except for any liability which by law cannot be excluded), for any error, inaccuracy in, or omission from the information contained in this material for any loss or damage suffered by any person directly or indirectly through relying on the information.

Keep reading...