Cybersecurity Alert: Ask Your Technology Provider to Check Your PHP Software
Law firms and title agencies rely heavily on websites, online forms, customer portals, and other internet-based systems. Many of those systems use PHP, a common technology that operates behind the scenes and may be managed entirely by a website developer, hosting company, managed service provider, or software vendor.
Recently identified PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, create an important reason to check those systems now. According to the information provided, the vulnerabilities may allow an attacker to remotely execute code on an affected internet-facing system without first obtaining login credentials.
For law firms and title agencies, that deserves prompt attention.
Why This Matters to Our Industry
Title professionals and law firms routinely handle sensitive customer, financial, transaction, and property information. Cybersecurity is therefore not simply an IT issue. An unpatched internet-facing system can create risk for your organization, your customers, and the other parties involved in a transaction.
The challenge is that many businesses may be using PHP without realizing it.
PHP may be incorporated into your:
- Public website
- Online forms
- Customer or transaction portals
- Web-based applications
- Third-party software products
A website vendor, hosting provider, managed service provider, or software vendor may manage PHP for you.
What Should You Do?
You do not need to determine the answer yourself. Contact the technology providers responsible for your websites and internet-facing systems and ask them to confirm whether you are affected.
Consider sending them this question:
Do any of our websites, applications, or externally accessible systems use PHP, including PHP incorporated into a third-party product? If so, are they affected by CVE-2026-109618 or CVE-2026-109619, and have they been updated to a patched version?
If PHP is present, ask your provider to confirm that the affected system has been updated appropriately.
Organizations using older PHP versions should also pay particular attention to whether the version remains supported and eligible to receive security fixes.
Technical personnel can obtain current PHP releases through the official PHP downloads page or through the applicable operating system, hosting provider, or software vendor’s update process.
Don’t Assume Someone Else Has Taken Care of It
When technology is managed by a third party, it can be easy to assume that security updates happen automatically. That may not always be the case.
A better approach is to ask and document the response:
- Contact your IT, website, hosting, managed service, and applicable software providers.
- Determine whether any internet-facing systems use PHP.
- Ask whether CVE-2026-109618 or CVE-2026-109619 affects those systems.
- Confirm that affected systems have been updated to a patched version.
- If a system was exposed, work with your cybersecurity professionals to determine whether additional investigation is appropriate.
- Document the inquiry and the remediation performed.
A Five-Minute Question Can Prevent a Much Larger Problem
Cybersecurity does not require every lawyer, title agent, or agency owner to become a technology expert. It does require us to ask the right questions of the people who manage our technology.
If you are not sure whether your website or systems use PHP, call your technology provider and ask. Do not assume you are unaffected.
Identify it. Update it. Verify it. Document it.
