By Adam J. Lynott

On October 21, 2026, researchers disclosed two critical vulnerabilities in PHP, the programming language behind millions of websites. Dubbed “PHP2Shell,” they prompted emergency patches and an NSA warning. The TL/DR version: an attacker could take over a vulnerable web server without ever logging in.

You might be thinking, “We don’t run PHP.” That may be true, but your vendors might. Community banks often rely on third parties to host websites and customer-facing applications, which could be vulnerable.

What should you do?

Start by contacting your website hosting provider and vendors supporting internet-facing services. You don’t need a full vendor assessment. A few questions will tell you what you need to know:

• Are any of the services you provide to us affected by PHP2Shell?
• Have you applied the patches? If not, what protections are in place, and when will patching be completed?
• Have you seen any suspicious activity tied to these vulnerabilities?

Document vendor responses and follow up on unresolved concerns. Prioritize critical customer-facing services. The NSA recommends immediate patching, increased monitoring, and taking vulnerable systems offline if necessary.

What about your customers?

Don't forget your business customers! Many operate their own websites and could be exposed to these same vulnerabilities. Consider sending a notification encouraging them to contact their website hosting providers, verify whether they're affected, and confirm that patches have been applied.

For your other customers, remind them to access online banking through official websites or apps, avoid suspicious links, and enable multifactor authentication.

Communication is important, even when there's good news. If you've confirmed your bank isn't affected by PHP2Shell, or that all affected systems have been patched, let your customers know. A brief update can provide reassurance while demonstrating that you're taking cybersecurity seriously.

If a compromise does affect customers, communicate promptly, stick to verified facts, and meet applicable notification requirements.

The bottom line

PHP2Shell reminds us that security doesn't end at our own network. Talk to your vendors, confirm the fixes, and keep your customers informed. None of that requires a mountain of paperwork, and it goes a long way.