Melbourne Marketing Brief / #039 / NEWS & ANALYSIS
Critical PHP fixes: check with your website host
Published by Ajay Dabhi · · AI-assisted research and writing
22 October 2026 · REPORTING + LOCAL BUSINESS ANALYSIS
If your website uses PHP, ask the host today whether the newly released security fix is running. A plugin update or firewall badge does not answer that question. A separate Cloudflare notice also calls for checks of certain office devices, tunnels and certificate configurations. The practical job is to get the right operator to confirm what applies and what has actually been updated.
PHP’s advisory and Cloudflare’s PHP-protection post are dated 21 October 2026. Cloudflare’s separate certificate-incident report is dated 20 October and entered the checked feed after our previous source checkpoint. All sources below were checked on 22 October 2026; their original dates are retained.
This edition uses AI-assisted research and writing. Ajay is not claimed to have personally inspected a customer website, tested these fixes or assessed a security incident. No customer system was scanned or changed. Examples are hypothetical, not client evidence.
ACT / CONTACT THE HOST
1. Confirm the PHP fix with the hosting operator
Security releases announced 21 October 2026
What changed
PHP’s maintainers released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow someone without a login to execute code remotely. The advisory urges immediate updates for PHP installations serving web requests. Distribution and long-term-support vendors may supply patched packages, so the operator must confirm the applicable fix.
Cloudflare says its php2shell WAF protections are deployed automatically on all plans with WAF deployed, including Free. It also says customers still need to update PHP: changing website code or plugins alone does not fix a flaw in the runtime. These are Cloudflare’s protection statements, not a check of any particular customer domain.
Published 21 October 2026. Source checked 22 October 2026.
Published 21 October 2026. Source checked 22 October 2026.
Who this affects
Australian businesses whose websites or connected web applications run on PHP, and the hosts or developers maintaining them. Owners whose relevant systems do not use PHP can ignore this PHP update. If the stack is managed for you, ask the provider rather than guessing from the site’s appearance. This report does not establish that a Growthcenter account or any other hosted product uses affected software.
Our analysis: what it means for your business
Our analysis: a useful completion record names the site or application, the responsible host, the fixed package now running and the time it was applied. “Everything is up to date” is hard to evaluate if it refers only to the content-management dashboard. Keep the runtime update and the website’s visible content updates as separate questions.
Hypothetical example: a Melbourne plumbing company has a website that sends quote requests to its office. The owner asks its current host to assess the PHP advisory and apply the relevant fix. After the host confirms completion, a clearly labelled sample enquiry is checked through to the office. That verifies one business path after maintenance; it is not a security audit or evidence that the site was previously compromised.
The business concern is continuity: the website must remain available, and the team must still receive enquiries after maintenance. The advisory does not tell us that any particular business has lost a booking or exposed data. If the operator sees signs of an incident, it needs its own investigation; a successful update alone does not settle that question.
Have the operator retain a recovery plan while making the urgent update. If an older environment needs a vendor backport, ask for that vendor’s confirmation. Do not treat a working homepage, a plugin update or a firewall protection claim as proof that the PHP remediation is complete.
What to do next
- Send the official PHP advisory to the existing host and ask today whether the relevant site or application is affected.
- Request confirmation of the fixed runtime or vendor-patched package that is actually running, who applied it and when. Let the qualified operator choose the appropriate supported update path.
- After maintenance, check a labelled enquiry or booking journey with the office and record any failure. Keep the host’s recovery and incident-response contact available.
CHECK / DEVICES AND CONNECTIONS
2. Check the Cloudflare software your team runs
Cloudflare report dated 20 October 2026 · Checked 22 October
What changed
Cloudflare reports that private keys associated with eight eMudhra intermediate certificates were compromised, an issue it became aware of on 19 October. Its 20 October report describes provider-side mitigations and updates for Cloudflare One/WARP, the 1.1.1.1 app and Cloudflare Tunnel. This is a separate incident from the PHP vulnerabilities.
Cloudflare’s table lists desktop client version 2026.8.2115.0 and Tunnel version 2026.10.2; mobile targets vary by app and operating system. It also asks some customers to review their own TLS trust stores, origin configurations and container images. Follow the product-specific table linked below. Cloudflare’s reported lack of identified active exploitation is limited to its review of its own services; it is not an Internet-wide finding.
Published 20 October 2026. Source checked 22 October 2026.
Who this affects
Businesses and IT operators using the named Cloudflare clients, a self-managed cloudflared tunnel or the customer-managed configurations in the vendor notice. Teams using none of these can skip the Cloudflare-product update steps. Other software may have separate vendor guidance; this edition is not an inventory of every affected product.
Our analysis: what it means for your business
Our analysis: first separate what the provider operates from what your business operates. A managed service can be updated while an office laptop or self-managed connector remains on an earlier version. Assign the device or connector check to the person who can verify it, rather than closing the whole task because a provider has announced mitigations.
Hypothetical example: an Australian service business uses a Cloudflare client on staff laptops and a tunnel to an internal scheduling tool. Its IT operator checks both components against the vendor table, updates the applicable software and confirms that the scheduling connection still works. A successful browser visit alone would not establish that the tunnel or a background application uses the same certificate-verification path.
The practical consequence to watch for is a connection failure after trust settings change. Give staff a clear way to report that failure and keep a temporary operational fallback for essential scheduling work. Do not solve certificate errors by disabling verification; the operator should investigate the certificate chain or configuration instead.
No customer devices or connections were tested for this edition. The recommendations are a way to obtain a bounded completion record, not a claim that an update guarantees security or improves bookings. Your existing IT provider may already have handled the relevant work; ask for its record before arranging duplicate maintenance.
What to do next
- Have the current IT operator identify whether the team uses the named client, app, Tunnel or customer-managed trust configuration.
- Use Cloudflare’s exact product and operating-system table to choose applicable updates. Record deployed versions and any required restart or redeployment.
- Verify the connection through the actual business application after the change. Escalate certificate errors to the operator instead of turning verification off.
ANALYSIS / BUSINESS CONTEXT
Where to spend your attention today
Today’s two reports belong with the people maintaining the website and office systems. Keep the completion evidence specific: what was affected, what was updated, when it became active and which essential business path was checked afterward. That makes it easier for an owner to follow up without having to administer the server.
The sources do not establish that any reader’s business was compromised. They also do not justify ignoring an applicable update. The next step is a prompt check with the existing operator, followed by a record of the work and its limits.
Commercial context: Ajay Dabhi sells website and automation services, including Growthcenter-related work. The invitation below is separate from this reporting and analysis. The existing host or IT provider may already be responsible for these updates.
Practical checks
- Confirm whether the website or connected application uses PHP; route the advisory to its current host.
- Keep provider-side protections separate from evidence that the runtime, device or connector has been updated.
- Check one labelled enquiry, booking or scheduling path after maintenance and retain the operator’s completion record.
These checks are recommendations, not additional requirements announced by the platform. The appropriate work depends on your actual configuration.
Publisher and editorial information
Ajay Dabhi publishes this report and also sells marketing and automation services. The commercial invitation above is separate from the sourced reporting. No client account test or direct interview is claimed in this report.
Research and writing use AI assistance. Original documents are linked so readers can check the facts. Read our ownership, sourcing and corrections policy or report a correction to Ajay.
All Melbourne Marketing Brief editions →