PHP2Shell: What the Critical PHP Flaws Mean for Law Firm Websites

On October 21, 2026, the PHP project shipped emergency releases for two flaws tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. PHP rates them 9.2 out of 10; some researchers rate them 10. Either way the effect is the same: an attacker who can reach a vulnerable server over the Internet can run code on it without a login. The identifiers leaked a day before the fix, and proof-of-concept exploit code was circulating by release day.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches (7.4 through 8.1) received source patches only, with no official release, so a host still on those versions has to rebuild PHP itself or move the site.

Why this lands on law firms

Most law firm websites run WordPress, and WordPress is PHP. So are the intake forms, client portals, and booking plug-ins attached to those sites. A compromised web server holds whatever the site collects: contact-form submissions describing legal problems, uploaded documents, portal logins, and the saved credentials the site uses to connect to the firm's email, calendar, and payment tools.

Under the professional conduct rules in Florida and most other states, a lawyer must make reasonable efforts to prevent unauthorized access to information relating to a client's representation, and competence includes understanding the risks of the technology the firm uses. A firm that cannot say what its website runs on, or when it was last patched, has a hard time showing either.

Three questions for your host, by email

First: what version of PHP is our site running right now? The answer should be one of the four fixed versions, or a dated statement that the source patch was applied to an older branch.

Second: on what date and time was the PHP2Shell fix applied to our server? "We patch automatically" is not a date. If no date arrives within one business day, treat the site as unpatched.

Third: what does our site store on the server? If the first two answers are missing, take the intake form offline until they arrive and rotate the credentials the site uses for any connected service.

The structural fix

Static websites served from a content delivery network have no PHP, no server-side login, and nothing on the server to steal. They are not immune to every problem, but they are immune to this entire class of problem. Every site LexAIAdvisors builds is static for that reason, and the firm sites we manage were unaffected by PHP2Shell. Where a client does operate a PHP system, our standard is a dated patch record verified from outside the server, not a vendor's assurance that updates are automatic.

If you do not know what your firm's website runs on, that is the first finding of a website risk baseline. Request one at /audit. This article describes a published software vulnerability and general professional-conduct principles; it is not legal advice.