For many small and medium-sized businesses in New Zealand, a website is more than an online presence. It is an important business tool for generating enquiries, accepting bookings, selling products and communicating with customers.
Whether you operate a retail store in Auckland, a tourism business in Queenstown, a construction company in Hamilton or an online store serving customers across New Zealand, keeping your WordPress website secure is essential.
On 21 October 2026, the PHP development team released urgent security updates addressing two critical vulnerabilities affecting PHP, the programming language that powers WordPress and many other websites.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell and have been rated Critical, with a CVSS v4.0 score of 9.2 out of 10.
New Zealand's National Cyber Security Centre (NCSC) has urged organisations to apply the security patches promptly and investigate potential compromise.
For NZ businesses using WordPress, the message is clear:
Update your PHP security patches as soon as possible, but follow a safe upgrade process to avoid website errors, broken functionality or unexpected downtime.
This guide explains what the vulnerabilities mean for New Zealand businesses, how to update WordPress and PHP through your web hosting provider, and what precautions you should take before making changes.
Why Should New Zealand SMEs Be Concerned?
Many New Zealand businesses rely on WordPress because it is flexible, cost-effective and easy to manage.
Common examples include:
- Local service businesses using contact forms and online quote requests.
- Retailers operating WooCommerce online stores.
- Restaurants and hospitality businesses accepting online bookings.
- Professional service firms collecting client enquiries.
- Tourism operators managing reservations and payments.
- Small businesses using WordPress for marketing and lead generation.
A security vulnerability in PHP can potentially affect the underlying server that processes website requests, even when the WordPress application itself is fully updated.
What could happen if your website is compromised?
Business interruption
A compromised or unavailable website can interrupt customer enquiries, bookings and online sales.
Customer data exposure
Attackers may gain access to information available to the affected PHP process, potentially including customer records, business data or application credentials.
Damage to customer trust
Visitors may lose confidence if a business website is defaced, redirects to malicious pages or displays security warnings.
SEO and online visibility problems
Malware, spam pages, unauthorised redirects and prolonged website outages can negatively affect website usability and search engine visibility.
Unexpected recovery costs
Recovering a compromised website may require specialist support, malware removal, restoring backups and investigating unauthorised access.
For an SME with limited IT resources, preventing these problems is usually much easier than recovering from a serious security incident.
What Are the October 2026 PHP Vulnerabilities?
PHP is the server-side programming language responsible for executing much of WordPress's functionality.
The October 2026 security release addresses two critical vulnerabilities:
- CVE-2026-109618: A memory corruption vulnerability associated with out-of-memory handling.
- CVE-2026-109619: A memory-management vulnerability involving stale internal state and use-after-free conditions.
Under vulnerable conditions, these weaknesses could allow an unauthenticated attacker to execute malicious code on the server.
The vulnerabilities affect PHP installations serving web requests, including common hosting environments such as Apache, PHP-FPM and LiteSpeed.
These are PHP runtime vulnerabilities, not vulnerabilities caused specifically by WordPress, Divi, Elementor or WooCommerce.
Important: Updating WordPress core or installing a security plugin does not automatically patch PHP. The hosting server's PHP runtime must also receive the appropriate security fixes.
Which PHP Versions Should NZ WordPress Websites Use?
The PHP project released the following security patches on 21 October 2026.
| PHP Branch | Minimum Security-Fixed Release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 or older | Upgrade or obtain verified vendor security backports |
For most modern WordPress installations, PHP 8.4 is a practical choice when compatibility has been confirmed.
PHP 8.5 is also suitable for websites running compatible WordPress, theme and plugin versions.
However, the safest choice is not necessarily the highest available PHP version. It is a supported, security-patched PHP release that is compatible with your website.
Some hosting providers apply security patches through vendor-specific packages without changing the displayed upstream PHP version. Ask your provider to confirm whether both CVE fixes are installed.
How to Check Your WordPress PHP Version
You do not need advanced technical knowledge to check which PHP version your website uses.
Method 1: WordPress Dashboard
- Log in to your WordPress dashboard.
- Navigate to Tools → Site Health.
- Select the Info tab.
- Expand the Server section.
- Find the PHP version.
For example, you might see:
PHP version: 8.5.11
Unless your hosting provider has applied verified security backports, this version should be updated to PHP 8.5.12 or newer.
Method 2: Your Web Hosting Control Panel
Most web hosting providers allow you to review PHP settings.
For cPanel hosting:
- Log in to cPanel.
- Find MultiPHP Manager or Select PHP Version.
- Locate your domain.
- Review the selected PHP version.
Some hosting panels display only the PHP branch, such as PHP 8.5, without showing the complete patch number.
If you are unsure whether the security fixes have been installed, contact your hosting provider.
Before Updating PHP: Protect Your WordPress Website
One of the most common concerns for business owners is:
Will updating PHP break my WordPress website?
The answer is that it can, particularly when upgrading between PHP branches or when a website uses outdated themes, plugins or custom code.
For example, moving from PHP 7.4 to PHP 8.5 carries considerably more compatibility risk than updating from PHP 8.5.11 to PHP 8.5.12.
A patch-level update is usually less disruptive, but testing is still important.
Possible issues include:
- WordPress displaying a critical error.
- A blank page or HTTP 500 error.
- Contact forms failing to submit.
- Divi Builder or Elementor not loading correctly.
- WooCommerce checkout or payment gateway errors.
- Custom PHP code producing fatal errors.
- Booking systems or third-party integrations malfunctioning.
For an NZ business that depends on its website for revenue or customer enquiries, these problems can directly affect operations.
Step 1: Take a Complete Website Backup
Before updating, back up your WordPress files and database.
You can use a hosting backup system, cPanel Backup Wizard or a reputable WordPress backup solution.
Ensure the backup includes:
- WordPress files and media uploads.
- Themes and plugins.
- The WordPress database.
- Configuration files.
Store a backup copy outside the hosting account and confirm it can be restored.
Step 2: Update WordPress, Themes and Plugins
Log in to WordPress and navigate to Dashboard → Updates.
Check for updates to:
- WordPress core.
- Your active theme.
- Plugins.
- WooCommerce and payment extensions.
- Page builders such as Divi or Elementor.
Apply compatible updates and check that your website still works.
For older websites, update in manageable stages rather than changing every component at once.
Step 3: Check PHP Compatibility
Before selecting a new PHP branch, review the compatibility requirements of your themes and plugins.
Pay particular attention to older or custom-developed plugins.
For example, PHP removed the create_function() function in PHP 8.0. A legacy plugin that still uses this function can trigger a fatal error when running on newer PHP versions.
Step 4: Test Using a Staging Website
For important business websites, a staging environment is strongly recommended.
A staging website is a private copy of your live website where updates can be tested before affecting customers.
For example:
staging.yourbusiness.co.nz
Test the new PHP version and check that the website works correctly.
Make sure staging is access-controlled and does not expose customer information.
Step 5: Choose a Suitable Maintenance Window
Schedule significant upgrades outside peak business hours where possible.
For example, a New Zealand online retailer may prefer to avoid changing PHP during a major promotion or busy sales period.
For WooCommerce websites, coordinate the update carefully to avoid disrupting active transactions.
Do not delay critical security patches unnecessarily. If immediate patching is not possible, discuss temporary access restrictions with your hosting provider.
How to Update PHP in cPanel Without Breaking WordPress
Many New Zealand WordPress websites use shared hosting with cPanel.
The following steps apply when a compatible, security-patched PHP version is already available.
Step-by-Step cPanel PHP Upgrade
Step 1: Log in to your cPanel hosting account.
Step 2: Open MultiPHP Manager under the Software section.
Step 3: Find your WordPress domain.
Step 4: Record the current PHP version.
Step 5: Select the appropriate patched PHP branch.
Step 6: Click Apply.
Step 7: Visit your website and check its functionality.
Step 8: Log in to WordPress and confirm the PHP version under Site Health.
Step 9: Review error logs and test important website features.
Important: Changing PHP Versions Is Not the Same as Installing Security Patches
If your hosting panel already shows PHP 8.5 but the installed release is PHP 8.5.11, selecting PHP 8.5 again may not install PHP 8.5.12.
The hosting provider must make the patched PHP package available and ensure the relevant PHP workers are running the updated version.
On shared hosting, customers generally cannot install server-level PHP packages themselves.
If the required patch is unavailable, contact your provider rather than repeatedly switching PHP versions.
What If Your Hosting Provider Has Not Released the PHP Patch?
Some hosting providers may take time to deploy security updates across their infrastructure.
If PHP 8.5.12 is not available, contact your hosting provider immediately.
You can send the following message:
Subject: Urgent PHP Security Patch Request – WordPress Website
"Hello Support Team,
My WordPress website is currently running PHP 8.5.11.
I understand that critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed on 21 October 2026.
Could you please confirm whether the required security patches have been applied to my hosting server?
If not, when will PHP 8.5.12 or an equivalent patched release be available?
Please also confirm whether any additional security measures are required.
Thank you."
What if the hosting provider cannot patch immediately?
New Zealand's NCSC advises organisations that cannot promptly remediate affected services to consider disabling public-facing web services until they can be protected.
For SMEs, this may mean temporarily restricting website access or using a server-level maintenance page.
A normal WordPress maintenance-mode plugin may still execute PHP, so it should not be treated as complete protection against a PHP runtime vulnerability.
What to Do If Your WordPress Website Goes Down After Updating PHP
If your website becomes unavailable after changing PHP, follow a structured recovery process.
Step 1: Identify the Error
Common error messages include:
- "There has been a critical error on this website."
- HTTP 500 Internal Server Error.
- A blank white page.
- PHP fatal error messages.
These problems often indicate plugin, theme or custom-code incompatibility.
Step 2: Check Error Logs
In cPanel, review Metrics → Errors or the PHP error logs provided by your host.
A developer can also temporarily enable WordPress debug logging, ensuring that errors are not displayed publicly.
Step 3: Check Incompatible Plugins
If a particular plugin is causing a fatal error, update or temporarily disable it.
When the WordPress dashboard is inaccessible, an administrator can use cPanel File Manager or SFTP to rename the affected plugin directory.
Do not disable payment, booking or other business-critical plugins without understanding the consequences.
Step 4: Use WordPress Recovery Mode
WordPress may send an administrator email containing a Recovery Mode link after certain fatal errors.
This can help restore administrative access and identify the problematic component.
Step 5: Restore Service Safely
If necessary, temporarily revert a PHP version change to diagnose the issue, but do not leave a known vulnerable version exposed to the public internet.
If the site cannot operate on a patched PHP release, restrict access while fixing compatibility issues.
Restore a verified backup if other changes have damaged the website.
Remember: A PHP update does not normally delete your WordPress website or database. Most post-upgrade outages are caused by compatibility or configuration problems.
Essential Security Checklist for NZ Small Businesses
PHP patching is only one part of WordPress security.
Every New Zealand SME should consider the following basic website security practices:
- Keep PHP, WordPress, themes and plugins updated.
- Use strong passwords and multi-factor authentication.
- Remove unused or abandoned plugins.
- Maintain regular off-server backups.
- Enable HTTPS and keep SSL certificates valid.
- Use a reputable web application firewall.
- Limit administrator access to trusted users.
- Monitor unusual logins and unexpected file changes.
- Check hosting security notifications regularly.
- Arrange periodic website security and maintenance reviews.
Businesses collecting personal information should also consider their responsibilities under the New Zealand Privacy Act 2020.
If a security incident results in a privacy breach that has caused or is likely to cause serious harm, notification obligations may apply. Businesses should assess incidents promptly and obtain appropriate advice where necessary.
A Practical WordPress Security Plan for New Zealand SMEs
A simple maintenance schedule can help businesses reduce security risks and unexpected downtime.
| Frequency | Recommended Activities |
|---|---|
| Immediately | Apply critical PHP and other security patches |
| Weekly | Review WordPress, plugin and theme updates |
| Weekly | Check backups and basic security alerts |
| Monthly | Review website performance, forms and error logs |
| Quarterly | Review user access, plugin inventory and recovery procedures |
| Before major changes | Create backups and test in staging |
Critical security updates should not wait for a routine monthly maintenance window.
For SMEs without an in-house IT team, assigning responsibility for website maintenance to a trusted developer or hosting provider can help ensure that important updates are not overlooked.
Final Thoughts: Secure Your WordPress Website Without Disrupting Your Business
The October 2026 PHP security vulnerabilities highlight an important lesson for New Zealand businesses: website security involves more than installing WordPress updates.
Your website depends on multiple components, including WordPress, PHP, themes, plugins, databases and hosting infrastructure.
If one of these components is vulnerable, the entire website may be exposed.
At the same time, making changes without proper preparation can lead to avoidable downtime, broken functionality and interrupted business operations.
For New Zealand SMEs, the most effective approach is to:
- Confirm the hosting provider has applied the relevant PHP security patches.
- Back up the website before making changes.
- Check WordPress, theme and plugin compatibility.
- Test significant upgrades in staging.
- Apply the updates promptly.
- Verify website functionality after updating.
- Investigate any signs of compromise.
A secure website protects more than your online presence. It helps protect your customers, business operations and reputation.
Maintaining a WordPress website requires regular attention to security, compatibility, performance and reliability.
I'm Jayantha Kumara, a Web Developer and SEO Specialist based in Auckland, New Zealand, working with WordPress, PHP, Laravel, website development, SEO and website maintenance.
If your business needs assistance with WordPress updates, PHP compatibility issues, website maintenance or technical SEO, you can get in touch through my website.
Contact Me for WordPress Security Update Audit
References
- New Zealand NCSC – Critical PHP Vulnerabilities
- NZ Government – Businesses Urged to Update Websites
- WordPress – Critical PHP Security Release
- WordPress – How to Update PHP
- PHP Official Website
- New Zealand Privacy Commissioner