If you've seen headlines this week about "PHP2Shell," you might be wondering whether it affects your office. You don't need to understand the technical details, but it's worth knowing what happened and who should be taking action. Here is the short version.
What Is PHP?
PHP is a common programming language that runs behind the scenes on a huge number of websites. If your housing authority's website is built on WordPress, Drupal, or Joomla, it almost certainly uses PHP. So might other web-based tools your office relies on, such as vendor portals or online forms. Most people never see it, the same way you never see the wiring inside a wall.
What Went Wrong?
On October 21, 2026, the group that maintains PHP released emergency fixes for two serious flaws, together nicknamed "PHP2Shell." Both are rated 9.2 out of 10 for severity.
In plain terms, the flaws could let an attacker take control of a web server without needing a password or login. Think of it as a door that could be opened from the outside without a key. The problem is in PHP itself, so even a website that is otherwise up to date can be exposed if the PHP underneath it hasn't been fixed.
Adding to the urgency, details about the flaws became public before the fixes were ready. The U.S. National Security Agency and CISA, the federal cybersecurity agency, both urged organizations to patch right away. Reports say some government websites were temporarily taken offline while they updated.
Is It Being Used in Attacks?
Reports differ, and the situation is changing quickly. CISA said it hadn't seen attacks when it first published its alert. Other security companies have reported early attempts to take advantage of the flaws. The safe assumption is that attackers are trying, and that fixing it promptly matters.
Who Needs to Fix It?
This is not something office staff fix themselves. The fix has to be applied on the computer (server) that hosts the website. That is usually handled by one of these:
- Your website hosting company
- The company that built or manages your website
- Your IT support
If your office has a website, a resident portal, or any web tool that your own team hosts, someone needs to confirm it's been updated. Websites running older PHP versions (8.1 or earlier) don't have official fixes, and CISA recommends taking them offline until they're upgraded or protected.
What Should You Do?
Ask your website provider. Send a short message: "Has our website been updated for the October 2026 PHP security fix (PHP2Shell)?" Ask for a yes or no, and a date.
Expect some short outages. Hosts may take websites down briefly to update. A short outage this week is likely a sign of maintenance, not an attack.
Watch for fake "security alert" emails. Scammers often use big news stories as cover. Don't click links in unexpected emails about this issue, even if they look official. Verify with your provider or IT support directly.
Report anything odd. If your website suddenly looks different, shows strange pages, or redirects somewhere unexpected, tell your IT support right away and don't try to fix it yourself.
Keep your own computers updated. This flaw affects web servers rather than office desktops, but the same habit protects you from most threats.
What About Your Resident Information?
If your website only shows public information, the risk is mostly to the website itself. If any web tool in your office collects resident information, it's even more important to confirm it has been updated. If you aren't sure, ask.
A related, narrower PHP issue was reported days later, and a permanent fix is still pending. Website hosts can apply a temporary setting in the meantime, so it's another reason to stay in touch with your provider.
The Bottom Line
This is a serious flaw, but the response is a clear one: the software has been fixed, and the people who manage your website need to install the fix. You don't need to panic or learn anything technical. You just need to make sure someone has the job and has done it.
If you aren't sure who manages your website, or whether any of your tools use PHP, give us a call and we'll help you find out.
