On October 21, 2026, the PHP project released emergency fixes for two serious flaws in PHP, the software that runs behind every WordPress site and a large share of the rest of the web. The flaws are now called PHP2Shell. Either one can let an attacker take control of a web server with a single request and no password. CISA put out an alert the same day telling organizations to find every system running PHP and patch the internet-facing ones first (cisa.gov). Within hours, the security firm watchTowr reported attempts to exploit the flaws (The Hacker News). As of this writing, no one has publicly confirmed a successful break-in.
If your firm’s website runs on WordPress, start there. Then go to the client portals your website links to, because those run on servers you do not control, whether or not your own website uses PHP. Nothing you change in WordPress, no page edit and no plugin update, fixes this. Whoever operates the server has to update PHP and restart it. Your job as CCO is to find out who that is for each system and get it in writing that they did it.
That can take more digging than you expect. The company that designed your website is often not the company that runs the server it sits on, and the PHP version number your site shows may not tell you whether the fix is installed. Start with the checks you can safely make yourself, then send the written request below to the companies that run your website and client portals.
The rest of this article is free to read with a BrainTrust account. Free members also get every Insight, the Securing Compliance exam report, the Mock SEC Cyber Exam, and the Document Review Matrix. Name and email, no card.