Technology Update Summary
If you saw last week's headlines about a flaw in something called PHP that "puts 70% of the internet at risk," here's our take: it's a big deal for the people who run websites, and generally a much smaller deal for your financial accounts, at least directly.
On October 21, the team that maintains PHP, a long-established and widely used web programming language, released emergency fixes for two critical vulnerabilities nicknamed "PHP2Shell." The flaws could allow an attacker to take control of an affected web server without logging in. Details leaked ahead of the release; some government websites went offline as a precaution, and researchers observed attackers probing for vulnerable systems.
Importantly, these vulnerabilities do not, by themselves, mean that the systems holding your investment accounts, statements, or financial plan have been compromised.
1. What PHP actually is
PHP is a programming language that a huge share of the web uses to turn a standard template into a functioning web page.
It has been around since the mid-1990s and is everywhere on the public-facing web. Roughly 70% of websites with a server-side language use PHP, and WordPress, which powers more than 40% of websites, runs on it. That's why the alarming "70% of the internet" headline has a basis in reality, even though it doesn't mean 70% of websites were successfully compromised.
Look more closely at that 70%, and you'll find blogs, news sites, brochure sites, restaurant menus, church bulletins, and, yes, financial advisor websites. PHP is especially common in publishing, which is exactly what WordPress was built for. Core custodial systems, portfolio accounting platforms, and bank ledgers generally operate in a very different part of the technology world. The fact that PHP powers so many public websites does not mean those financial systems share the same vulnerability.
2. Where PHP shows up in our world
In the financial advice business, one of the most visible places PHP appears is an advisor's public website: the site with our team's bios, office hours, quarterly market commentary, and "schedule a call" button.
Many advisor websites are built on WordPress by marketing vendors such as FMG Suite and Snappy Kraken, and WordPress runs on PHP. Financial Advisor magazine reported last week that major advisor website providers were addressing the issue from day one. Broadridge said its 19,000-plus advisor websites do not use PHP, while FMG reported that its PHP patching was current.
Think of an advisor's website as a storefront window. It is not the vault where you hold your financial assets. Your accounts sit with your custodian; your plan lives in planning software; and your statements come from separate enterprise systems. A flaw in a marketing website should not be confused with a flaw in those underlying platforms.
3. What the realistic risk looks like
If an advisor website were compromised before it was patched, possible outcomes include a defaced page, visitors being redirected to a suspicious site, or a fake login page appearing on the firm's domain. Those events could be disruptive and concerning, but they would not, on their own, mean your custodial accounts had been breached.
The more important secondary concern is what a compromised marketing site could reveal. Researchers have shown that these PHP vulnerabilities can expose sensitive information, including passwords and keys, in an affected server's memory. Qualys documented these critical vulnerabilities before the patch release. What an attacker could obtain depends on the website and the information it stores or processes.
For a typical marketing site, that might include contact-form submissions or newsletter lists: names, email addresses, and possibly phone numbers. It does not automatically mean access to account numbers or balances. Still, a list of people who have contacted an advisor is exactly the kind of information a scammer could use to craft a convincing fake email. That's where much of the practical risk lies: phishing.
4. What you can do
The main risks to keep in mind are disruptions to websites and phishing attempts that try to take advantage of information or trust associated with a familiar firm. The same safe internet habits that protect you from PHP2Shell-related scams help protect you from many other threats.
- Question unexpected emails or texts about your accounts, especially messages asking you to click a link, log in, or move money. If a message claims to be from your custodian or us, call using a phone number you already know and trust.
- Keep two-factor authentication enabled for your custodian login and your email.
- Tell us if something looks unusual. If our website looks odd, is unexpectedly unavailable, or sends you somewhere unfamiliar, let us know. There's no need to panic, but it's worth reporting.