What happened this week?
Two security teams, Calif and Wiz, found serious flaws hiding inside PHP. PHP is the programming language that sits underneath most of the web. WordPress runs on it. So do Joomla, Drupal, and Wikipedia.
The flaws have a name, PHP2Shell, and two official tracking numbers (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 for severity. According to Wiz, every PHP version released in the last decade is affected, going back to PHP 5.4.
In plain English: a stranger on the internet could send a website a specially built request and take control of the server behind it. No password needed. No login needed. Once in, they could change pages, plant malware, or read stored data.
The PHP team released a fix on Wednesday, October 21. The response was so serious that the BBC reported the Finnish government, the Dutch cyber security agency, and parts of Wikipedia took sites offline until they could patch.
How did AI find a flaw that humans missed for 20 years?
The bugs were not new. They had been sitting in PHP for many years. What changed is that AI made them possible to find and prove.
OpenAI says a researcher at Calif found one of the critical flaws using its GPT-5.6 Sol model, as part of a program called Patch the Planet. Wiz found both flaws on its own, also with the help of AI. Wiz wrote that proving the flaws could be exploited "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve."
The good news is that the defenders got there first. OpenAI, Wiz, the PHP team, Cloudflare, and others spent about two months quietly building and testing the fix before going public.
The bad news is that the same tools are available to attackers. SecurityWeek reported that Amazon saw the first attack attempts on October 17, four days before the fix came out, and that PHP2Shell is now "being broadly exploited in the wild." The Guardian reported millions of attempts against websites worldwide on October 22.
Is my law firm's website affected?
If your site runs on WordPress, the answer was almost certainly yes before this week's patch. Most family law and estate planning firm websites are built on WordPress.
Whether you are still at risk depends on one thing: has your server been updated to a fixed version of PHP? These are the fixed versions, per the PHP security team:
| PHP version line | Safe version or higher |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | No longer supported. Ask your host about a patched build, or upgrade to 8.2 or newer. |
One important point: updating WordPress, your theme, or your plugins does not fix this. The flaw is in PHP itself, on the server. Only a patched PHP fixes it.
If your site is on a site builder like Squarespace or Wix, the platform handles its own servers. It is still worth asking them, but you do not manage PHP yourself.
How do I check my site's PHP version?
If you have WordPress admin access, it takes about a minute:
- Log in to your WordPress dashboard.
- Go to Tools, then Site Health, then the Info tab.
- Open the Server section and look for PHP version.
- Compare it to the table above.
If you are not comfortable doing this, that is fine. That is what your web team or host is for.
Has my web host already fixed it?
Many large hosts moved fast. Flywheel and WP Engine reported finishing their patches on October 21 and 22. Kinsta, Cloudways, and GoDaddy's web hosting have also reported patching. SiteGround said it disabled the affected functions on all supported PHP versions while fixes rolled out. Bluehost was still rolling out patched builds on October 22.
Host status is changing by the hour, so do not assume. Check your host's status page or ask them in writing. If you are on a cheap shared plan, a VPS, or a server someone set up years ago and nobody looks at, you are the most likely to be behind.
Why does this matter more for law firms?
Most small businesses would lose a website for a few days. A law firm can lose a lot more.
Your website probably collects some of the most private information people ever share. Contact forms and intake forms hold details about divorces, custody fights, abuse, money, health, and family estates. Some sites store those form entries right inside WordPress.
The ABA Model Rule 1.6(c) asks lawyers to make "reasonable efforts" to prevent unauthorized access to client information. Your state's version may differ, and this is not ethics advice. But a known, public, critical flaw with a free fix is the kind of thing that is hard to explain later if it was ignored.
There is also the trust side. Someone going through a divorce may visit your site late at night from a phone. If that visit triggers a browser warning, or your homepage has been changed by an attacker, they will call the next firm.
What should I ask my web team today?
Send these five questions to whoever manages your website. You should get clear answers within a day.
- What PHP version is our site running right now, and is it a patched version?
- Who hosts our site, and has the host confirmed the PHP2Shell patch?
- When was our last full backup, and where is it stored?
- Do our contact or intake forms store submissions inside the website? If so, can we stop storing them there?
- Is anyone watching our site for updates every month, or only when something breaks?
If nobody can answer question five, that is the real problem to fix.
What does this mean for the future?
OpenAI wrote that these bugs "are among several significant vulnerabilities we've already found," and that it expects "similar findings to increase sharply in the coming months."
That tells you where things are heading. AI will keep finding old holes in the software the web runs on. Defenders will patch faster. Attackers will move faster too. The gap between "a fix is out" and "someone is trying it on your site" is now hours, not weeks.
The firms that come through this fine will not be the ones with the fanciest website. They will be the ones with someone checking updates every month, keeping backups, and keeping sensitive client data off the website when it does not need to be there.
At Up And Social, we have been checking client websites this week, and we will keep doing it monthly. If you are not sure who is watching your firm's site, now is a good time to find out.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name for two critical security flaws in PHP, the programming language behind about 70% of websites, including WordPress. They were made public on October 21, 2026, and could let an attacker take over a web server without a password.
Does PHP2Shell affect WordPress websites?
Yes. WordPress runs on PHP, so WordPress sites on an unpatched PHP version are exposed. The fix is updating PHP on the server to 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a host's patched build.
Will updating my WordPress plugins fix PHP2Shell?
No. The flaw is in PHP itself, not in WordPress, themes, or plugins. Plugin updates are still good practice, but only a patched PHP version fixes PHP2Shell.
Did ChatGPT find the PHP vulnerability?
A researcher at the security firm Calif found one of the flaws using GPT-5.6 Sol, an OpenAI AI model, through OpenAI's Patch the Planet program. The security firm Wiz also found both flaws independently using AI tools.
Is my law firm's website still at risk?
It depends on whether your host has updated PHP. Many major hosts patched on October 21 and 22, 2026, but you should confirm your exact PHP version and ask your host in writing.
Related guides
- Why estate planning websites lose the client at "Contact Us"
- AI marketing for family lawyers: what works in 2026
- How AI Overviews are changing how clients find family law firms
Want to know how your firm looks to Google and AI search right now?
We will check Google, the map pack, and AI tools like ChatGPT and show you where your firm shows up, where it doesn't, and who shows up instead.
This article is general information for law firm owners. It is not legal, ethics, or cybersecurity advice. Facts are current as of October 22, 2026. Check with your web host and IT provider about your specific setup.