ACSC alert status: Critical · 21 Oct 2026
Is your website affected by the PHP security flaws?
Two critical flaws in PHP, the software behind WordPress and many business websites, went public on 21 October. Enter your web address to see what your server shows and get an email to send your host.
- Free, no account
- Nothing to install
- Only reads what the public can see
21 Oct 2026
Official alertAs reported by
What happened on 21 October
Your website can look perfect and still be exposed.
PHP 8.2.29
PHP 8.3
PHP 8.4
PHP 8.2- 7 in 10
websites run on PHP
W3Techs, Oct 2026This figure covers websites whose server-side programming language is known.
In the news
Reporting on the PHP security flaws
21 Oct 2026Critical vulnerabilities in PHP
Read the official alert ↗Australian government sites among those exposed to ‘critical’ PHP software flaw
Read on ABC News ↗PHP update: Why are so many websites down and when will they return?
Read on SBS News ↗PHP2Shell: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline
Read on iTWire ↗21 Oct 2026Critical alert! Aussie cyber agency warns businesses to monitor PHP vulnerabilities
Read on Cyber Daily ↗ASD rushes out ‘critical’ alert on unpatched PHP vulnerability
Read on The Mandarin ↗Govt sites go down after AI finds ‘critical’ PHP vulnerabilities
Read on Information Age ↗23 Oct 2026Critical vulnerabilities in Fortinet products
Read the official alert ↗How the free check works
Check your website for free in three steps.
Enter your web address, confirm your details and get your result.
What you need
Just your web address. Lexi starts from the same page your customers see.
All Lexi needsNot needed- Your login
- Your password
- Anything installed
- Access to your server
How the free check works
Check your website for free in three steps.
Enter your web address, confirm your details and get your result.
01 Enter your website
Enter your website
FreeWhat you need
Just your web address. Lexi starts from the same page your customers see.
All Lexi needs- Your login
- Your password
- Anything installed
- Access to your server
02 Lexi reads the public signs
Lexi reads the public signs
FreeLexi
What Lexi reads
What your server shows any visitor, compared with the 21 October fixes. This usually takes under a minute.
- PHP version8.3.12 · older than the fix
- Version shown to the publicShown
- Server restarted after the updateAsk your host
- Written confirmation from your hostAsk your host
- Under a minute
- Public signs only
03 Get your answer
Get your answer
FreeYou
What you get
See your result and the email to send your host. No account needed.
Your server shows PHP 8.3.12, which is older than the fix.
- Your PHP version
- Both CVE numbers
- The fixed versions
- What to confirm
Copy emailOpen in my email
Free, no account. Nothing to install.
- Log in to your site
- Change anything
- Attack or stress it
- Share your result
Why one check is not enough
Two critical alerts in three days.
Australia's cyber agency issued another critical alert two days after PHP. Not every alert touches websites. Talk to our team about Watch and the monitoring available for your site.
- 21 OctCritical alert: PHPASD's ACSC
- 22 OctGovernment sites taken offline to patchABC News
- 23 OctCritical alert: Fortinet productsASD's ACSC
- NextNot public yetTalk to our team about Watch
Plans
Start with a free website check.
You can see your result and use the host email without buying anything.
Free check
Start hereFree
Check the public signs of PHP on your site and get an email to send your host.
Your answerAct now
Your server shows PHP 8.3.12, which is older than the fix.
Email to your host: written for you- One check of your site
- A plain answer
- The email to your host
- No account needed
No account needed to see the result.
Watch
A$49/ month
Talk to our team about Watch and the monitoring available for your site.
Talk to us about WatchFull security check
A$199once
Our team reviews your website and email setup. Includes a report, a 15 minute call and one recheck.
Book a checkPaid services start after we agree the scope with you.
Who is checking
Talk to the team behind Lexi.
LexiLive is the Australian team behind Lexi. Talk to us if you need help with your result or a PHP fix.
People you can reach
You talk to the people who built Lexi, here in Australia.
Help with your result
Our team explains your result and the next step.
A record of your check
See what was checked and when.
Your data stays yours
Your business has its own space. Leave any time and we delete our copy within 30 days.
Questions
Questions about the check
What the check does, what it can tell you and what comes next.
Does Lexi touch my website?
No. The free check reads only what any browser can already see. It sends no attack traffic, tries no logins and does not look for hidden files.
Do I need to give you a password?
No. The free check needs only your web address. If we fix something for you later, you give us access through your host's own user feature. We never ask for a password by email.
What if my result says ‘Check with your host’?
Your result needs written confirmation from your host. Send them the draft email and ask them to confirm your PHP version and patch status.
I use Wix or Squarespace. Do I need this?
Wix and Squarespace manage their own servers and updates, so there may be nothing for you to change. The check can still show what is visible from outside.
What does Watch do?
Watch is A$49 a month. Talk to our team about the monitoring and checks available for your website.
What does the full security check cover?
Your HTTPS, security headers, the software anyone can see, email spoofing protection, your domain, and your host's written answer on PHP. You get a plain English report, a fix plan, a 15 minute call and one recheck within 30 days.
How much does a fix cost?
Every site is set up differently, so we quote each fix before we start. Nothing on your site changes until you say yes.
Do your prices include GST?
No. Prices are shown excluding GST, which is added to your invoice where it applies.
Check your website for free.
See your result and get an email to send your host. No account needed.