PHP2Shell: What the Emergency PHP Fix Means for Your Firm’s Systems and Data

When a critical vulnerability makes national news, most law firms ask one simple question: does this affect us? For the PHP flaws disclosed this week, the answer depends on where your firm runs PHP and what it connects to.

On October 21, the PHP project released an emergency fix for two critical security flaws in PHP, the programming language behind WordPress, Drupal, Joomla, and a large share of the web. The Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately, noting that the flaws allow an attacker to run code on a server without logging in and affect every PHP installation that serves web requests.

At Innovative Computing Systems, we believe law firms shouldn’t have to suffer preventable technology problems or handle an event like this on their own. Below is what was found, the two ways it can reach a law firm, and how we handle the work so your team can stay focused on clients.

What happened

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and researchers have nicknamed them “PHP2Shell.” Both score 9.2 on the CVSS v4.0 scale, placing them in the critical range. Researchers at Calif, Wiz, and OpenAI found and reported them, and the underlying problem dates back roughly a decade of PHP releases, up to version 5.4.

The PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Its release notes leave little room for interpretation: no complete workaround exists, and updating is the only safe choice.

The timing was compressed. The fix was scheduled for October 22, but details leaked a day early, so the PHP Foundation moved the release up to October 21.

Why it matters for a law firm

Three things make this event more serious than a routine update.

First, the flaw is in PHP itself, not in one website or plugin. A system can be exposed even when its own code is well built and kept current. Wiz demonstrated taking control of up-to-date WordPress, Drupal, and Joomla sites without a login.

Second, an attacker doesn’t need a full takeover to cause harm. Wiz showed that the flaws can also read a server’s memory, which may hold passwords, login tokens, and API keys. Credentials like these are what link outside services to a firm’s email and data, which makes this a client confidentiality and reputation question for managing partners as well as a technical one.

Third, AI shortened the timeline. According to Wiz, frontier AI models allowed a single researcher to build working attacks in about a week, work that would previously have taken a specialist team months. We wrote about this shift in The Attackers Have AI Too. PHP2Shell shows this in practice, with less time between a flaw being found and being used.

Two ways PHP2Shell can reach a firm

PHP rarely appears on a firm’s system inventory, which makes events like this hard to track down. It tends to show up in two places.

Systems inside the firm’s environment. Some internal tools and vendor-supplied applications run on PHP on the firm’s own servers or cloud infrastructure. These systems sit closest to client files and firm data, and they need the update applied directly.

Outside services connected to the firm. A firm’s public website, contact and intake forms, and some client portals are usually built and hosted by a web agency, hosting company, or software provider, and that provider delivers the PHP update on those servers as part of the service. As Greenbone notes, providers update PHP in hosting control panels and vendor software on their schedule. What links these services to the firm is a set of credentials: the email account that delivers form submissions, or the integration that passes intake details into firm systems. If a vulnerable server leaked those credentials, the risk follows them back to the firm. We covered a broader version of this question in “Knowing Which Vendors Hold Your Client Data.”

Older PHP versions need a plan

Official releases only cover PHP 8.2 through 8.5. For versions 7.4, 8.0, and 8.1, the PHP security team published limited source-code patches meant for teams that build PHP themselves, and version 7.3 and earlier received no fixes. Scans published by several security firms this week found that most internet-facing servers reporting a PHP version run one of these end-of-life releases.

Older applications often stay in service because a workflow or a vendor depends on them. As with Windows Server 2016 reaching end of support, an unsupported PHP version calls for a plan to upgrade, replace, or isolate the system, with interim protection in place until that plan is complete.

Where exploitation stands

Reports have moved quickly since the release. Amazon Threat Intelligence recorded an attack attempt on its decoy servers on October 17, four days before the fix, and now describes PHP2Shell as broadly exploited. watchTowr, Cloudflare, and other security firms have also reported attack attempts. CISA said it had not observed exploitation when it issued its alert, and as of early October 22, it had not added either flaw to its Known Exploited Vulnerabilities catalog.

There is also some measured news. After further analysis, Sansec concluded that widespread successful attacks are less likely than it first expected, because the public exploits don’t work against a default PHP installation and an attack depends on specific conditions on the target server.

Taken together, the right response is prompt, steady action. Amazon also recommends starting investigations on October 17 rather than the release date, and that is where our review begins.

How Innovative Computing Systems takes this off your plate

You shouldn’t have to learn how a web server handles memory to know whether your firm is exposed. When a vulnerability like PHP2Shell is announced, we own the response across the environment we manage, from the first alert to the confirmed fix, so your administrators get their time back and your systems stay safe, secure, and reliable.

We identify where PHP runs in your environment. Our documentation and asset inventory give us visibility into the servers and applications we manage, so we can quickly locate affected systems instead of starting from scratch.

We patch, restart, and confirm. We apply the fixed releases, restart the PHP services so the update takes effect, and verify that the corrected version is running. That closes the exposure on those systems and gives you a documented record that the work is done.

We protect the connections between outside services and your firm. Where your website, intake forms, or portal reach the firm through an email account or integration in systems we manage, we rotate those credentials if exposure was possible. That means a key read from a vulnerable web server can’t be used to reach your email or your firm’s data.

We look back as well as forward. Our 24/7 monitoring and managed detection services watch the systems we manage for unusual activity, and we review that activity from October 17 forward, so an attempt made before the patch existed doesn’t go unnoticed.

We build a plan for older systems. For applications on unsupported PHP versions, we put interim protections in place and develop an upgrade or replacement plan through our strategic reviews, with costs your firm can budget for in advance.

For firms with an internal IT director or manager, this work runs alongside your team. We handle patching, monitoring, and credential work, so your team can stay focused on the firm’s priorities.

Innovative Computing Systems has worked exclusively with law firms for 37+ years, and more than 100 firms nationwide trust us with their technology. Our 100% U.S.-based support team is available 24/7/365, which means an emergency release on a Wednesday morning gets attention that same morning. We’ve got your back.

Keeping your firm’s technology friction-free

Events like PHP2Shell are a major reason firms partner with Innovative Computing Systems. We keep a current picture of the environment we manage, act on critical vulnerabilities as soon as fixes are available, and protect the connections between your firm and the outside services it relies on, so your attorneys stay focused on clients and your administrators stay focused on running the firm. You deserve better than discovering exposure through a headline.

To learn how we handle emergency patches and security events for law firms, request a free consultation. A Solutions Consultant will follow up to review your needs.