PHP2Shell Is Being Exploited: What RIAs Should Ask Vendors Under Reg S-P

On October 26, 2026, CISA added two critical PHP flaws known as PHP2Shell to its Known Exploited Vulnerabilities catalog. Attackers are actively using them against unpatched web servers right now. For a registered investment adviser, the exposed server is rarely sitting in your office. It is your firm website, your client login page, your document upload form, and the outside vendors running them.

Your written vendor oversight policy probably says service providers will tell you within 72 hours if something goes wrong. PHP2Shell is a good test of whether that policy holds up in production. This post covers what was confirmed, what an advisory firm should ask its vendors this week, and what to keep on file for the next SEC exam.

Executive takeaway

• What happened: On October 26, 2026, CISA added CVE-2026-109618 and CVE-2026-109619 (PHP2Shell, CVSS 9.2) to its Known Exploited Vulnerabilities catalog after researchers confirmed active unauthenticated remote code execution against web-facing PHP servers. (CISA)
• Why it matters under Reg S-P: Amended SEC Regulation S-P (effective December 3, 2025 for larger firms and June 3, 2026 for smaller firms) requires documented service provider oversight, a 72-hour vendor breach notice rule, and client notification within 30 days of awareness. (Parker Poe)
• What you own: Even when an outside vendor patches the server, your firm owns the vendor oversight record. You need written confirmation of which vendors run PHP, when they patched to a fixed release, and whether they checked exposed systems for compromise.
• The Defensible IT test: If an SEC examiner asked tomorrow which of your web vendors run PHP and when they patched CVE-2026-109618, could you hand over dated written replies from each provider?

What is PHP2Shell, and why did CISA add it to the KEV catalog?

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on a web server without logging in. Both carry a CVSS score of 9.2. CISA added them to its Known Exploited Vulnerabilities catalog on October 26, 2026, after researchers confirmed working attacks. (CISA)

The PHP security team shipped fixes on October 21. On October 24, Adel Karimi, detection and response lead at Perplexity, recorded confirmed remote code execution against a honeypot running Apache mod_php on PHP 8.4.26. Expel researcher Marcus Hutchins called it the highest quality confirmation of in-the-wild exploitation he had seen. (BleepingComputer)

Federal civilian agencies have until October 29, 2026 to patch. That deadline does not legally bind a private advisory firm, but it tells you how seriously the government rates the risk. (The Hacker News)

Which PHP versions fix PHP2Shell?

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, shipped by the PHP security team on October 21, 2026. CISA's alert covers PHP installations that serve web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, with mod_php at the highest risk. For PHP 8.1 or earlier, there is no fixed release. CISA's guidance is to take those systems offline if they cannot be upgraded. (CISA alert)

Does PHP2Shell matter if my firm does not run PHP directly?

Yes, because your third-party web hosts, client portals, and marketing vendors probably do. PHP runs roughly 70% of websites, and CISA warns that it is often embedded inside other software, so it may be present without anyone listing it. InvestmentNews reported that advisor WordPress sites, client login pages, document upload forms, and scheduling tools are the exposed surface for wealth management firms, and that the larger risk sits with web hosts, CRM add-ons, and portal providers. (InvestmentNews)

The Hacker News tracked dozens of software and appliance vendors issuing their own PHP2Shell advisories, including WordPress, Drupal, Salesforce, Okta, Veeam, SonicWall, Citrix, and Ivanti. When a tool in your stack shows up on an advisory list like that, the vendor owns the patch, but your firm owns the oversight record.

Why is a PHP vulnerability a Regulation S-P problem for RIAs?

Because amended SEC Regulation S-P makes service provider oversight and incident response a written, testable compliance obligation for registered investment advisers. Larger SEC-registered firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. The amendments require a written incident response program, oversight of service providers that includes a duty for them to notify you within 72 hours of a breach affecting customer information systems they maintain, and notice to affected individuals no later than 30 days after you become aware that sensitive customer information was, or is reasonably likely to have been, accessed without authorization. (Parker Poe)

That 30-day clock starts at awareness, not at the end of the vendor's investigation. If your client portal provider was exposed and cannot tell you whether it was checked for compromise, you have a gap that an examiner will find faster than an attacker would.

State-registered advisers and other non-SEC financial firms are generally covered by the FTC Safeguards Rule instead, which has its own requirement to oversee service providers and to notify the FTC of certain security events. (FTC) Either way, the work this week looks the same: find the exposure, get written answers, and keep the evidence.

Our IT compliance services for financial firms and financial and regulated industry IT programs start with this kind of vendor map, because most advisory firms have never written down which outside systems hold client data.

What did the SEC say about cybersecurity in its FY2027 exam priorities?

On October 23, 2026, the SEC's Division of Examinations released its fiscal year 2027 priorities, naming operational resiliency, cybersecurity, third-party vendor risk, and amended Regulation S-P compliance as core focus areas across more than 34,000 registrants. (SEC) InvestmentNews reported that examiners will look at governance, data loss prevention, access controls, incident response, third-party risk, and compliance with amended Regulation S-P. (InvestmentNews)

What should RIAs and wealth advisors do about PHP2Shell this week?

This week, advisory firms should map every web system that touches client data, confirm each one runs a fixed PHP release, send written questions to every vendor, check exposed systems for signs of a break-in, and file dated evidence in their Regulation S-P records.

1. Inventory every web tool that touches client data. List your public website, client portal, tax or document upload page, scheduling widget, e-signature workflow, and CRM integrations. Note the vendor, the underlying web host, the internal owner, and whether sensitive client information passes through it.
2. Get the exact PHP version on systems you control. If your firm's website runs on managed WordPress or a VPS, have your web host or IT provider confirm the running PHP build in writing. Prioritize internet-facing servers first.
3. Put the vendor questions in writing. Send the four questions below by email or support ticket. A verbal assurance on a phone call won't satisfy an SEC examiner; a timestamped reply will.
4. Hunt for post-exploitation activity, not just missing patches. Attackers were exploiting PHP2Shell before many hosts patched. CISA warns defenders to inspect web servers for PHP worker processes spawning shells (sh, bash, cmd) or fetching remote payloads. A WAF rule buys time, but both CISA and Cloudflare call it a temporary stopgap, not remediation.
5. Log the awareness timestamp if anything looks wrong. If a vendor or web host finds unauthorized access to systems holding customer data, trigger your incident response plan, loop in privacy counsel and cyber insurance, and record the exact date and time you learned of it. That timestamp starts your 30-day Regulation S-P notification clock.
6. Drop the paper trail into your compliance folder. Save the vendor replies, PHP version confirmations, and log review notes in your Regulation S-P service provider oversight file with the reviewer's name and date.

What should an RIA ask each vendor in writing after PHP2Shell?

An RIA should send four written questions to every website host, portal vendor, and SaaS provider that stores, processes, or displays client information, and file their dated responses in the firm's Regulation S-P oversight folder:

• Do you run PHP anywhere in the systems that store, process, or display our client information?
• Which PHP version is running today, and on what date did you move to a fixed release?
• Did you review exposed systems for signs of compromise, and what did you find?
• If you found unauthorized access, when will you notify us under our contract and Regulation S-P?

If a vendor cannot answer the first question, that answer goes in the file too. It tells you something about the vendor.

Standard IT vs. Defensible IT: what is the difference when a vendor flaw hits?

Standard IT takes the web developer's word that everything is updated and moves on. Defensible IT maintains a live vendor inventory, collects written version and compromise attestations within days, inspects process logs, and hands an SEC examiner a dated folder proving every step.

Standard IT hears about PHP2Shell and asks whether the website is fine. Defensible IT can show the examiner which vendors run PHP, which version each one is on, the date each one answered, and who reviewed it.

Standard IT looks like this:

• Nobody knows which vendors host client data, so nobody knows who to ask.
• The website host says it is handled, and that is the end of the conversation.
• Patching is treated as proof that nothing happened.
• The incident response plan sits in a binder and has never been run against a real event.
• Nothing is written down, so the firm cannot show an examiner what it did.

Defensible IT looks like this:

• A current inventory of every web system and vendor that touches client data, with an owner for each.
• Written vendor answers on PHP version, patch date, and compromise review, filed by date.
• 24/7 managed detection and response watching for web processes that spawn shells or pull down tools.
• A Regulation S-P incident response program that has a step for "a vendor flaw is being exploited," so the first day is a checklist instead of a guessing game.
• Compliance-first managed IT services that keep patch levels documented, not just applied.

How does Emry Networks help advisory firms build Defensible IT?

Emry Networks provides IT compliance services for RIAs and financial firms, cybersecurity services with 24/7 MDR, and managed IT services for wealth advisors across the United States, with operational hubs in the Jacksonville, FL area and the Manchester, NH area. You can see how we align engineering controls to each regulatory framework on our regulated industries page.

For an advisory firm, the work follows the three phases of the Emry Assurance Roadmap:

• Phase 1: Red Zone (Regulatory Discovery). We map every website, client portal, Microsoft 365 tenant, and third-party vendor that touches client data, record PHP and platform versions, and compare your written Regulation S-P or FTC Safeguards program to what is actually running.
• Phase 2: Transition (Security Hardening Sprint). We close the gaps in production: fixed releases on systems you control, written vendor attestations, Identity and Access Management (IAM) with Microsoft Entra Conditional Access, CrowdStrike EDR backed by 24/7 human-led MDR, immutable backups with tested restores, and an incident response runbook your team has walked through.
• Phase 3: Green Zone (Continuous Management and Drift Control). We review service providers on a set schedule, track CISA KEV advisories within 24 to 48 hours, verify backup restores quarterly, and keep your dated Regulation S-P evidence file ready so the next critical flaw is a routine checklist.

Want to know where your firm stands? Book a 30-Minute Regulation S-P & Vendor Risk Assessment. We will look at your web surface, your vendor oversight file, and your incident response program, and tell you plainly what an examiner would find.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities rated CVSS 9.2 that allow unauthenticated remote code execution on PHP that serves web requests. CISA added both to its Known Exploited Vulnerabilities catalog on October 26, 2026.

Which PHP versions are safe from PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fixes released on October 21, 2026. PHP 8.1 and earlier have no fix, and CISA advises taking those systems offline if they cannot be upgraded.

Is our firm website at risk if a hosting company manages it?

It can be. Managed hosts generally patch shared platforms, but you should get the running PHP version and patch date from your host in writing and keep it in your vendor oversight file.

Does a vendor's PHP2Shell exposure trigger Regulation S-P notice?

Exposure alone does not. Notice duties apply when sensitive customer information was, or is reasonably likely to have been, accessed without authorization. Under the amendments, service providers must notify you within 72 hours of a breach, and you must notify affected individuals within 30 days of becoming aware. Confirm the specifics with your counsel.

Is a web application firewall enough to stop PHP2Shell?

No. CISA and Cloudflare both describe WAF rules as a stopgap. The fix is a patched PHP release, plus a check for signs of compromise on systems that were exposed before patching.

What will SEC examiners ask about vendor cybersecurity?

The SEC's FY2027 exam priorities list operational resiliency, cybersecurity, and protection of customer information. Expect questions about your incident response program, how you oversee service providers, and what evidence you keep.

Do state-registered advisers have to follow Regulation S-P?

Regulation S-P applies to SEC-registered firms. State-registered advisers and many other financial firms are generally covered by the FTC Safeguards Rule, which also requires service provider oversight and certain breach notices. Check which rule applies to your firm with counsel.

What four questions should an RIA send vendors after a CISA KEV alert like PHP2Shell?

Ask each vendor in writing: (1) whether they run PHP in any system touching your client data, (2) which PHP version is running today and the date it was patched, (3) whether they checked exposed servers for post-exploitation activity, and (4) when they will notify your firm under your contract and Regulation S-P's 72-hour rule if unauthorized access is found.

How does the Emry Assurance Roadmap help RIAs respond to vendor vulnerabilities under Regulation S-P?

In Phase 1 (Red Zone), Emry inventories every website, client portal, and service provider touching customer data. In Phase 2 (Transition), Emry collects written vendor attestations, enforces IAM and Microsoft Entra Conditional Access, deploys CrowdStrike EDR with 24/7 MDR, and validates immutable backup restores. In Phase 3 (Green Zone), Emry maintains ongoing CISA KEV tracking and dated Regulation S-P exam evidence.