Two critical flaws in PHP, the code behind around 70% of websites, have set off a global rush to patch servers. Advisory firms whose websites, client portals or vendors depend on the software are caught up in it.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”, can let an attacker take control of a web server without logging in. Both are rated 9.2 out of 10 for severity. PHP’s developers released fixes at around 10 a.m. ET on Oct. 21, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which are available from php.net. The release was brought forward after details of the bugs leaked online the previous day.
The National Security Agency told organizations to prepare to update. It warned that flaws of this kind “often provide a direct path to the server’s file system or database”. Where an immediate update isn’t possible, the agency advised taking the system offline.
Attacks started quickly. Security firm watchTowr says its network of decoy servers recorded attempts to exploit both flaws on Wednesday. Cloudflare’s chief technology officer, Dane Knecht, called the company’s emergency firewall rules a “STOPGAP only”. No breach at a real organization had been confirmed by Wednesday afternoon.
Organizations around the world took sites offline while they waited for the fix. They included parts of Wikipedia, some Nintendo services, government portals across the Netherlands, Finland and France, and several UK council websites. Most did so as a precaution.
PHP builds a web page each time someone visits it, pulling information such as account details or login screens from a database and sending the result to the browser. It sits underneath WordPress, Drupal and many hosting platforms. Because the flaws are in PHP itself, a website can be exposed even if its own code is sound.
Few advisors will ever touch PHP, but many of their websites run on it. WordPress, which runs on PHP, is a common choice for small-business sites, including advisory firms’ marketing pages. Client login pages, document upload forms and scheduling tools attached to those sites could be open to attack if the server underneath hasn’t been updated.
WordPress sites have been a target before. In July, attackers went after two chained flaws in WordPress itself, dubbed WP2Shell, which allowed sites to be taken over without a login. PHP2Shell sits a layer lower, so it can affect WordPress and much of the rest of the web.
The larger risk may sit with vendors. Web hosts, CRM add-ons, portal providers and back-office tools often run PHP without saying so. Only versions 8.2 to 8.5 have official fixes, so a provider still on an older release has no simple update to install.
The timing is especially important for compliance teams. The SEC’s amended Regulation S-P took effect for larger firms on Dec. 3, 2025, and for smaller firms on June 3, 2026. Every covered firm now needs a written incident response program. Service providers must tell the firm within 72 hours of a breach involving customer information. Firms must notify affected clients as soon as practicable, and no later than 30 days after becoming aware of unauthorized access to sensitive customer information, unless they reasonably determine it won’t cause substantial harm or inconvenience.
That means a hacked vendor server isn’t just the vendor’s problem. If client data was reachable, the advisory firm has to decide whether to notify clients and keep a record of how it reached that decision. The SEC’s examination priorities for fiscal 2026 already name cybersecurity, Reg S-P and vendor oversight.
PHP2Shell also lands at the end of a bruising year for wealth management security. Mariner disclosed a cloud breach affecting nearly 9,000 people. Hedge funds including Point72 and Citadel were targeted by AI-powered voice phishing. Several other RIAs and broker-dealers have also reported attacks.
Investors reacted fast. Cloudflare, whose firewall protects millions of PHP sites, rose more than 5% in intraday trading on Wednesday. CrowdStrike and Palo Alto Networks also traded higher.
Security firms Calif and Wiz found the bugs using frontier AI models. OpenAI, whose model Calif used, called them “one of the most impactful security issues in recent memory”. If AI can turn decades-old code into an attack route this quickly, clients with holdings in software and cybersecurity may start asking how much corporate security spending needs to rise.
The first job is an inventory of every website, portal and vendor that touches client data. Firms should ask each provider in writing whether it runs PHP and whether it has moved to a fixed version. Those written answers also belong in the firm’s Reg S-P vendor oversight file.
Any server that was left unpatched on Wednesday should be checked for signs of a break-in, not just updated. If there’s any sign that client information was accessed, firms should start their incident response program, bring in counsel and notify their cyber insurer promptly. The 30-day client notification clock starts when the firm becomes aware of the breach, not when the investigation ends.
InvestmentNews will update this story as it develops.
As notetakers push into account opening, a consultant warns RIAs risk ‘buying redundancy’ instead of capability
The senior recruiter position at LPL Financial can lead to future success and industry leadership.
Unclaimed auto accounts can’t take family money, so advisors face questions on 529s, divorce terms, employer funding and stock gifts.
Better Markets’ Benjamin Schiffrin says the change clears a path for interval-fund and accredited-investor rules, but won’t touch daily advisor work.
Devenir finds 52% of HSA assets are now invested, reshaping how clients can plan for retirement health care costs.
Knighthead Life entered the market with a competitive MYGA. A strong launch earned advisor confidence and paved the way for FIAs.
As AI makes financial information more accessible than ever, Lana Hock explains why human judgment, trust, and empathy remain the qualities clients value most in a financial advisor
