Orthodox Australia

This website is temporarily offline to protect it from a severe, worldwide PHP security vulnerability. It will be back as soon as the fix is installed.

The U.S. National Security Agency (NSA) has issued a worldwide URGENT computer security bulletin about PHP, the software that powers about 70% of the Internet. The flaw lets an outside hacker reach server-level controls and databases. Governments all over the world are taking their sites down, and this site uses PHP too.

"If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated." — NSA Cyber, October 21, 2026

Key details

"PHP2Shell" (CVE-2026-109618, CVE-2026-109619), rated 9.2/10: attackers can run code on servers without a password and steal credentials and user data.
All PHP versions since 5.4 are affected, including sites running WordPress, Drupal, Joomla and Magento.
The NSA, CERT-EU and the UK's NCSC urged immediate patching or isolation. Sites went offline in the Netherlands, Finland, France and Belgium.
Attacks began at 07:43 UTC on October 21, before the official fixes were released.