Updating WordPress Won't Fix the PHP Flaw Hitting Law Firm Sites

If your law firm's website runs on WordPress, it almost certainly runs on PHP, and a critical PHP website vulnerability was announced this week. A successful attack could change your phone number, reroute prospective clients to a fake site, or expose what people typed into your intake form. A fix is out, and here's how to tell whether your site has it.

What was announced, and what it can do to a law firm

On October 21, 2026, the group that maintains PHP released emergency updates for two critical flaws. PHP is the language that builds each page on your web server before a visitor sees it. WordPress is written in it, and according to W3Techs, roughly 69% of websites whose language can be identified use it.

The PHP team said there are no complete workarounds and that updating is the only safe choice. Government security agencies in the U.S. and U.K. urged organizations to update, or take the site offline if they can't.

The threat isn't only theoretical. Amazon recorded an attack attempt on October 17, four days before the fix was public. Cloudflare's chief executive said attempts jumped from thousands to millions after the announcement. None of that traffic has been tied to a confirmed break-in. One legal technology publication said it knew of no law firm website breach from this flaw so far.

A law-firm-focused advisory lists what an attacker could do with access: swap your phone number or payment instructions, redirect prospective clients to an impersonation site, add a fake login or document-upload page, or read contact and intake form data. Those are possible consequences, not reports of what has happened.

How worried you should be depends on what your site does. In my view, a client portal is the most exposed. Clients already trust it with sensitive documents, and firms often advertise it as the safe alternative to email. If it's breached, you could be looking at a large leak of personal information.

An intake form is less dangerous, in my judgment. It mostly holds names and phone numbers. That's still private, but it's harder to do real damage with. A plain brochure site is the lowest risk. The main thing I'd do there is double-check that the contact details are still correct.

Why your usual WordPress updates won't fix this

The flaw is in PHP itself, not in WordPress or any one plugin. So a site with every update current can still be exposed. WordPress's automatic updates don't change the PHP version on your server. Your hosting company or site administrator has to do that on purpose.

This matters most if your site is older. The oldest PHP versions no longer get security updates at all, and U.S. cybersecurity officials say organizations still on them should take those systems offline until upgraded. One report cited WordPress.org figures showing about 35% of WordPress sites run a PHP version with no security support.

There's also a professional angle. When a known flaw and a government warning exist, a delayed response is harder to justify to clients and regulators. A vulnerable site alone isn't a reportable incident. That only applies if the flaw was actually exploited and legal thresholds are met.

Three things to do before the end of the week

1. Find out which PHP version your site runs. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Write down the number and send it to your host or web person. Ask whether it is a supported version and whether it has this week's emergency fix. Anything that no longer gets security updates should be treated as urgent. A quick search, or an AI assistant, can also tell you whether your version is affected. Attackers are racing to use this flaw before sites get fixed.

2. Ask your host or web person for written confirmation that the fix is installed. Several big hosts, including GoDaddy, DreamHost and Namecheap, reported patching their shared or managed hosting on October 22. If your site sits on a private server, nobody patches it for you unless someone is assigned to do it. An email reply gives you a record.

3. Document what you did, then check your contact details. Note the date you learned of the issue, what you checked, and what you decided. Then confirm your phone number, email and intake forms still look right, and check that no unfamiliar login or upload pages have appeared. Regulated firms are expected to show a reasonable response, and a short written record is the simplest proof.

If you can't reach the person who built your site, or they don't know how to apply the fix, I'd advise shutting the site down until you can make sure it isn't vulnerable. That matters most when it handles customer intake, internal documents, or client portal logins. If it's only promotional, I wouldn't worry much, even if it changes a little in the meantime.

PHP itself is still maintained, with security support for the newest version running through 2029. The language isn't the problem. Old, unpatched installations are.

The flaw was found with AI tools and had sat in PHP for 14 years. Your site doesn't need to be rebuilt, but someone needs to own its updates.

At Cognaraz, we handle website redesign and migration for law firms whose sites run on old, hard-to-update software. We move your site to a cleaner, supported foundation, so security fixes stay simple and your site keeps bringing in inquiries.