On October 21, 2026, the developers of PHP released emergency fixes for two critical security flaws, nicknamed “PHP2Shell.” PHP is the programming language behind roughly seventy percent of the world’s websites, including every WordPress site. The flaws lets an attacker take control of a web server without a password, just by sending it a specially crafted request. Security firms and government agencies, including CISA, urged everyone running PHP to patch immediately. Attackers began trying to exploit the flaws within hours.
What ITS did
Every system we manage has been patched. That includes the websites we host, our application servers, and our control panels. We added temporary protections while patches were rolling out and confirmed each system afterward.
What we can’t do
Most businesses rely on dozens of outside websites and portals: banking and payment platforms, payroll, HR, security and alarm systems, training tools, accounting portals, and more. Those vendors are responsible for patching their own servers, but a breach on their side can still expose your logins and data.
Here are a few recommendations.
- Make a list of the business websites and portals your team logs into and note who owns each relationship.
- Ask the vendors if they were affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and whether they’ve patched. Prioritize any that hold sensitive data.
- Keep their answers on file. It’s good third-party risk practice, and auditors and examiners like to see it.
We’re glad to help check which of your vendors’ sites appear to use PHP, or to draft the vendor inquiry for you.
How does this impact you?
These flaws affect web servers, not your computer or phone. These flaws can’t reach your device simply because you visit a site. Your risk depends on what attackers do with the websites once they take over. Over the next several weeks, watch for:
- Fake update or “security alert” pop-ups on websites, especially ones asking you to download something. Close the page and don’t download anything.
- Phishing emails that use the news. Be wary of messages like “Urgent: PHP security update, log in to verify your account” or unexpected breach notices from vendors. Don’t click the link.Go to the site through your bookmark or by typing the address yourself.
- Unusual activity on vendor portals like unexpected password reset emails or logins you don’t recognize. Report it to IT right away.
Use multi-factor authentication wherever it’s offered. Use a different password for every vendor portal, so one leak doesn’t expose the others. When in doubt about an email or website, ask IT before you click.
If you have any questions, please reach out.