PHP2Shell for IFAs, Brokers and Wealth Managers: Patching Isn't Enough, Rotate Your Secrets Too
Most coverage of PHP2Shell, the two critical PHP vulnerabilities fixed on 21 October 2026, has focused on attackers taking over web servers. For financial services firms there's a quieter issue that deserves equal attention: the risk that secrets were read out of memory before the patch went on.
If you haven't caught up on the wider story, including government websites going offline and how quickly attacks began, start with our main article on PHP2Shell and the Cyber Essentials 14-day patching rule.
Why memory disclosure matters to an advice firm
Researchers who analysed the flaws showed that, alongside running code on a server, an attacker could read the memory of PHP worker processes, which can contain passwords, session tokens and API keys. Think about what your client onboarding forms, fact-find portals and website integrations might connect to:
platform and wrap provider integrations
CRM and client management systems
e-signature, identity verification and open banking services
email and document storage accounts
If a PHP application with access to those keys was exploited before it was patched, updating PHP closes the door, but it doesn't take back credentials that may already have been copied.
A four-step response
1. Confirm the patch. Every PHP-based system you own or that a supplier runs for you should be on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, with the service restarted. Get dates in writing from suppliers.
2. Establish the exposure window. Amazon's threat intelligence team found an exploit attempt on 17 October, four days before the flaws were made public. Treat any internet-facing PHP system as potentially exposed from that date until it was patched.
3. Rotate what the system could see. Change API keys, service account passwords and integration tokens used by affected applications, and invalidate active sessions. It's tedious, but it's far cheaper than an incident.
4. Look for misuse. Review logs at the services those keys unlock, not just on the web server itself. If you find evidence of compromise, the NCSC recommends getting help from an assured incident response provider.
Your supply chain is your exposure
Few advice firms run their own servers, so most of this risk sits with suppliers. The NCSC's guidance on responding to active exploitation advises organisations to make critical suppliers contractually responsible for fixing exploited, internet-facing flaws rapidly, and gives a target of within 24 hours for the most serious cases. That's a sensible clause to raise at your next supplier review.
Where Cyber Essentials comes in
Cyber Essentials v3.3 requires high and critical security updates within 14 days, unsupported software to be removed, and multi-factor authentication on every cloud service. That last point limits the damage when a password does leak, which is exactly the scenario above.
Fourteen days is the ceiling, not the goal. We recommend financial services firms work to 7 days as standard and treat actively exploited, internet-facing flaws as same-day work.
Among the Cyber Essentials benefits for advice firms is a simple, recognised way to show clients and partners that the basics are covered. If you're looking at how to get Cyber Essentials, our Supported service includes an assessor review of your cloud services and supplier arrangements before you submit. See more in our financial services resources.
Comments