PHP Vulnerability: Five Questions Every Accountancy Practice Should Ask Its Web and Portal Suppliers

5 days ago

3 min read

Accountants, bookkeepers and payroll bureaus sit on some of the most useful data a criminal can steal: bank details, tax references, payroll records and client identity documents. So when two critical PHP vulnerabilities, known as PHP2Shell, were fixed on 21 October 2026 and attacks began almost immediately, practices had good reason to pay attention.

You may not run a web server yourself. But your practice website, client upload portal, online forms or practice management system may well run on PHP, hosted by someone else. That's where the risk sits, and that's where the questions need to go. (For the full story, including the government websites that went offline, see our main article on PHP2Shell and the Cyber Essentials 14-day patching rule.)

Question 1: "Does anything you host for us run on PHP?"

Start with a list. Your website (especially if it's WordPress), any client document portal, online engagement or onboarding forms, and any self-hosted bookkeeping or practice tools. If your supplier isn't sure, that's an answer in itself.

Why it matters for Cyber Essentials: cloud and hosted services that store or process your organisation's data cannot be excluded from scope. You remain responsible for making sure the controls are met, even when a provider implements them for you.

Question 2: "When did you apply the PHP2Shell fix, and to which version?"

You're looking for a date and one of the fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. "We keep everything up to date" is not an answer. Ask for it in writing and keep it with your Cyber Essentials evidence.

Question 3: "Are any of our systems on an unsupported PHP version?"

PHP 8.1 and earlier may not receive a fix at all. Under Cyber Essentials, unsupported software must be removed or segregated from the internet, so an old PHP version behind your client portal is a fail, whether or not anyone has attacked it yet.

Question 4: "Have you checked for signs of compromise?"

Security researchers at Amazon recorded an exploit attempt four days before the flaws were made public and recommend investigating from at least 17 October. If your portal holds client documents, you need to know whether anyone got in before the patch. If they did, you may have reporting obligations to think about as well.

Question 5: "What's your patching commitment for the next one?"

This is the question that matters most. The NCSC has warned of a coming 'patch wave' as AI speeds up the discovery of old flaws. Cyber Essentials sets 14 days as the maximum for high and critical updates. We recommend asking suppliers to commit to 7 days as standard, and same-day action when a flaw is being actively exploited on an internet-facing system, in line with the NCSC's guidance on responding to active exploitation.

Don't forget your own devices

PHP2Shell affects servers, not staff laptops. But the same discipline applies across the practice: operating systems, browsers, accounting software and router firmware all fall under the same 14-day rule. Practices that left patching until the January self-assessment rush was over are exactly the ones that end up exposed.

Turning this into a client-facing advantage

Clients rarely ask how their accountant protects their data, until something goes wrong. One of the most practical Cyber Essentials benefits for a practice is being able to answer that question with a government-backed certificate. If you're weighing up how to get Cyber Essentials, our Supported service means an assessor checks your answers, including your suppliers' patching, before anything is submitted.

More guidance for practices is in our accountancy resources.