A PHP Security Alert Is a Reminder: Who Is Responsible for Your Law Firm Website?

On October 21, 2026, the PHP project released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution on affected servers. The advisory urged PHP users to update immediately. The affected technology is not a niche tool: PHP powers a large portion of the web and sits beneath many traditional law-firm websites, including many WordPress installations.[1]

This is not a reason to tell every lawyer that their website has been compromised. It is a reason to ask a more useful question:

If a serious vulnerability appears in the technology behind your firm’s website, who is responsible for knowing, patching, testing, and documenting the response?

For many small firms, the honest answer is unclear. The lawyer bought a site years ago. A former employee, freelance designer, marketing vendor, hosting company, or “IT person” holds some combination of the logins. A plugin update happens occasionally. Nobody has a simple answer about the PHP version, the hosting environment, the web application firewall, backups, or the plan if an update breaks something.

That is not a marketing problem. It is an ownership problem.

A WAF is useful—but it is not the patch: Cloudflare says its WAF protections were deployed as an additional layer of defense for the latest PHP vulnerabilities. The PHP project’s own advisory is more direct: updating is the complete remedy. A protective layer can reduce exposure while a patch is applied; it does not make an unpatched server safe.[1] [2]

What the PHP alert actually means

The PHP project identified two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under the right conditions, each can permit unauthenticated remote code execution on a server running vulnerable PHP. The PHP project lists releases that correct the issues and strongly encourages all PHP users serving web requests to update immediately.[2]

The technical details matter to administrators. The business point matters to law firms: a website is not simply a brochure. It is an internet-facing system with software underneath it. That software needs someone who knows what is running, follows the security releases, applies changes, checks the result, and keeps a recovery path if something goes wrong.

Cloudflare reported that it released managed WAF protections for its customers before public disclosure and observed attack traffic targeting customers. It also emphasized that customers should patch PHP even while WAF protections remain enabled.[1]

In other words, a security service may buy time and block some malicious requests. It cannot replace accountability for the server and software that run your site.

Why this matters for a traditional law-firm website

A WordPress website is not automatically unsafe, and this PHP vulnerability is not a WordPress-only issue. It affects the PHP runtime itself. Updating a theme or a plugin alone does not fix a vulnerable PHP installation; the PHP project says administrators need to apply the PHP software update, and firms on managed hosting should ask the provider to do so.[1] [2]

That distinction is important. Many firms are told that their site is “maintained,” but they never receive a clear description of what maintenance covers. Does it include core software? Plugins? Themes? The PHP runtime? The operating system? Backups? Security monitoring? A firewall? Testing after an update? Who owns the domain and DNS? Who can act when a security alert arrives on a Tuesday morning?

If the answer is a collection of assumptions, the firm has a gap—even if the website looks perfectly fine today.

The five questions every firm should ask its current website provider

You do not need to become a web-security specialist to get useful answers. Send these questions to the person or company that hosts and maintains your firm’s site.

1. Is our website running PHP, and if so, what version is currently in production? Ask for a written answer, not a general assurance that the site is “up to date.”
2. Who is responsible for applying urgent server-level security updates? Clarify whether the host, the website vendor, or the firm must act—and how quickly the responsible party responds.
3. What is our protective layer while updates are being applied? Ask whether there is a web application firewall, how it is configured, and who reviews blocked or suspicious events.
4. How are backups handled and tested? A backup only helps if it can be restored reliably and without guessing where the current files and database live.
5. Who controls the domain, DNS, hosting account, code, analytics, and administrator accounts? A firm should be able to identify the owner and access path for every essential account.

The answers may confirm that your provider has a disciplined process. If so, that is useful. But vague answers such as “the host takes care of it,” “WordPress updates itself,” or “we have security installed” should lead to follow-up questions.

Why a firewall helps—and why it cannot be the whole plan

A web application firewall, or WAF, evaluates incoming requests and applies rules intended to filter malicious traffic. Cloudflare describes its WAF as a tool for automatic vulnerability protection, managed rules, custom rules, rate limiting, and security-event review.[3]

Those are valuable capabilities. They can help block known exploit attempts, slow abusive traffic, and give a site operator visibility into what is happening at the edge of the site.

But a WAF is one layer. It does not remove the need to apply vendor fixes. The PHP advisory says that only an update is a complete solution for the newly disclosed vulnerabilities. Cloudflare likewise recommends keeping WAF protections enabled while patching—not instead of patching.[1] [2]

That is a useful principle beyond this one alert: a good website-security program uses layers. It does not depend on one plugin, one dashboard, or one reassuring email.

The cost of unclear ownership is usually paid at the worst time

Most law firms do not think about their website’s technical stack when it is working. The problem appears when a contact form stops reaching the firm, a security notification arrives, a site becomes unavailable, an update changes a page, or a lawyer needs to change a practice area quickly.

At that point, the firm may discover that:

• The old developer controls the hosting account.
• The domain renewal emails go to a former employee.
• No one knows which plugins or custom changes are safe to update.
• The backup is old, incomplete, or stored in an account nobody can access.
• The provider who sold the site does not handle server security.
• The firm has no practical way to make an urgent correction without waiting on several unrelated vendors.

A law firm does not need to run its own servers to avoid this. It does need a clear relationship with a provider that can explain the stack, own the maintenance process, and communicate in plain English when something changes.

When a move to a new platform makes sense

A security advisory is not automatically a reason to rebuild a website. If your current provider can identify the PHP version, confirm that the security update is applied, explain the protective controls, show a workable backup process, and respond quickly, the sensible next step may be to stay and document that process.

A move deserves consideration when the firm cannot get those answers, cannot reach the person responsible, depends on an aging stack with uncertain updates, or repeatedly pays separate vendors to solve ordinary website problems. A new platform can also make sense when security concerns are part of a broader issue: the site is slow, hard to edit, poorly organized for search, or no longer reflects the practice you are building.

The point is not to abandon a platform because it has a name you recognize. The point is to replace ambiguity with a website arrangement that has a real owner, defined maintenance, and a workable response plan.

A simpler option for attorneys who want one accountable team

Law Offices of Cleveland designs, builds, hosts, and maintains websites for solo attorneys and small firms. The platform is positioned as a modern alternative to a traditional WordPress install, with hosting, security, backups, and content edits included in a predictable monthly plan.[4]

For a firm considering a move, the first conversation should be practical:

• What content, pages, and conversion paths should carry forward?
• Which accounts and assets does the firm currently control?
• What should be rebuilt rather than copied?
• How will the new site be hosted, maintained, and updated?
• Who will handle ordinary edits after launch?

A website transfer should not mean throwing away the work your firm has already done. It should mean gaining a cleaner, better-supported platform with one team responsible for the ongoing work.

If your website has no clear owner, it is time for a conversation: LOC builds and maintains modern websites for attorneys and small firms. If you want a straightforward review of your current site and a plan to move it to a platform with hosting, security, backups, and ongoing edits in one place, request an attorney-website quote.

A practical next step for firm owners

Start with the five questions above. Ask for written confirmation of the software and hosting posture behind your current site. If your provider has clear answers and a documented process, you will know more than you did yesterday.

If the response is vague, slow, or fragmented, do not wait for a security alert to become a client-service problem. A modern law-firm website should have clear ownership, routine maintenance, a backup plan, and a team that can explain what it is doing.

Frequently asked questions

Is every WordPress law-firm website affected by the latest PHP vulnerabilities?

No. This alert concerns vulnerabilities in the PHP runtime, not WordPress alone. The relevant question is whether a site runs an affected PHP version and whether the host or administrator has applied the security update. The PHP project advises users of affected installations to update immediately.[2]

Does a web application firewall replace PHP updates?

No. A WAF can be a valuable protective layer that helps filter malicious traffic, but both Cloudflare and the PHP project emphasize that the PHP update remains necessary. WAF protections should remain enabled while the patch is applied.[1] [2]

What should a law firm ask its website host after a major security alert?

Ask what software and version the site runs, whether the relevant update has been installed, who handles urgent server-level patching, what protective controls are active, how backups are tested, and who controls the essential domain, hosting, and administrator accounts.

When is it reasonable to move a law-firm website to a new platform?

Consider a move when the firm cannot get clear answers about maintenance, patching, backups, access, and ownership; when several vendors create delay and confusion; or when security uncertainty accompanies a site that is already slow, hard to maintain, or no longer supports the firm’s marketing goals.

References

[1] Cloudflare, Cloudflare deploys protections against php2shell vulnerability

[2] PHP, Security advisory: Critical remote code execution vulnerabilities, update now

[3] Cloudflare, Web Application Firewall documentation

[4] Law Offices of Cleveland, Websites for attorneys