By Steven C. Fraser, Esq. | FL Bar No. 625825 | DC Bar No. 460026
On October 21, 2026, the PHP project released emergency fixes for two flaws it rates 9.2 out of 10, and that other researchers rate a flat 10. The pair has a name, PHP2Shell, and a plain description: an attacker who can reach a vulnerable PHP server over the Internet can make it run code of the attacker's choosing, with no password and no account. Proof-of-concept exploit code was circulating before the fix shipped, because the vulnerability identifiers leaked a day early.
That is a technology story. Here is why it is a lawyer story.
Your website is probably PHP
Most law firm websites run on WordPress, and WordPress is written in PHP. So are many of the intake forms, client portals, and scheduling plug-ins bolted onto those sites. If a firm's site was built by a marketing agency, hosted on a shared plan, and not touched since launch, there is a better than even chance it is running a PHP version that was vulnerable this morning.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older than the 8.2 series is past its end of life. The PHP project published source patches for those older branches but no official releases, which means a host running PHP 7.4 or 8.1 has to compile a fix itself or move the site to a supported version.
Why this is an ethics question and not just an IT question
A compromised web server is not a defaced homepage. It is a machine that holds whatever the site collects: contact-form submissions describing a legal problem, uploaded documents, portal logins, and the credentials the site uses to talk to the firm's email, calendar, and payment systems. Everything on that list is information relating to the representation of a client, or of a prospective client, and the Rules of Professional Conduct treat it the same way.
Florida. Rule 4-1.6(e) of the Rules Regulating The Florida Bar reads: "A lawyer must make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the client's representation." The comment to Rule 4-1.1 adds that maintaining competence includes "an understanding of the benefits and risks associated with the use of technology." A firm that does not know what its own website runs on cannot say it has made reasonable efforts to protect what the website holds.
Everywhere else. The ABA Model Rules carry the same two provisions, Model Rule 1.6(c) and Comment 8 to Model Rule 1.1, and most states, including the District of Columbia, have adopted one or both. ABA Formal Opinion 483 (2018) goes further and describes what a lawyer owes current clients when a breach does happen: a reasonable investigation, a reasonable effort to stop it, and notice to the clients whose information was or may have been exposed.
Reasonable efforts does not mean a lawyer must become a systems administrator. It means the lawyer must know who is responsible for the server, must have asked whether it is patched, and must have an answer in writing.
Three questions to send your web host today
Send these by email, not by phone, so the answer is a record.
What version of PHP is our site running right now? The answer should be one of the four fixed versions above, or a dated statement that the host has applied the PHP project's source patch to an older branch.
On what date and time was the PHP2Shell fix applied to our server? "We patch automatically" is not an answer. A date is an answer. If the host cannot give one within a business day, treat the site as unpatched.
What does our website store on the server? Intake submissions, uploaded files, portal accounts, and saved credentials for connected services. If the host cannot confirm the first two answers, take the intake form down until it can, and change the credentials the site uses for anything connected to it.
If the answers come back wrong, or do not come back, the host is telling you something about how the rest of the stack is maintained.
What we run, and why it matters here
Our public websites are static files served from a content delivery network. There is no PHP on them, nothing to log into, and nothing on the server to steal. Static sites are not immune to every problem, but they are immune to this one, and to the entire class of server-side flaws that PHP2Shell belongs to.
The one PHP system we operate is a self-hosted file server that is not public-facing in the way a website is. It was running a vulnerable version this morning. It was patched to PHP 8.3.36 within hours of the release, after a database backup, and the patch was verified from outside the server before this post was written. That is the standard: not that nothing is ever vulnerable, but that someone owns the question and can show the date.
The longer lesson
Every few years a flaw like this arrives, and every time, the firms that come through cleanly are the ones that already knew three things: what their website runs on, who patches it, and how to reach that person in writing. None of that requires technical skill. It requires asking before the week it matters.
If you would like a second set of eyes on what your firm's web presence actually runs, that is a conversation I am glad to have. Book a time at calendly.com/fraserlawyers.
Sources: PHP project security release of October 21, 2026 (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35); The PHP Foundation, "Today's PHP Security Release," October 21, 2026; Tenable and Qualys advisories on CVE-2026-109618 and CVE-2026-109619; Rules Regulating The Florida Bar, Rule 4-1.6(e) and comment to Rule 4-1.1 (October 2026 edition); ABA Model Rules 1.1 cmt. 8 and 1.6(c); ABA Formal Opinion 483 (2018).
Steven C. Fraser is admitted in the District of Columbia (1998) and Florida (2003) and practices in bankruptcy, tax controversy, consumer protection, probate, and related litigation. This article discusses a published software vulnerability and the professional conduct rules that bear on it. It is not legal advice and it is not an opinion on any particular firm's systems.