If your practice's website runs on WordPress, Drupal or Joomla, it uses PHP and needs the October 21, 2026 security update now. Contact and intake forms can hold private client information, so it's worth checking today.
PHP is software that runs behind many websites. It powers WordPress, Drupal and Joomla, and roughly 7 in 10 websites use it.
On October 21, 2026, the people behind PHP released emergency fixes for two critical security flaws. They're officially numbered CVE-2026-109618 and CVE-2026-109619, and nicknamed "PHP2Shell".
The flaws let an attacker run their own instructions on a website without a password. In plain words: they could break in and read or change anything on it.
Sources are listed at the bottom of this page.
Two critical flaws, CVE-2026-109618 and CVE-2026-109619, are fixed in new versions of PHP. Website owners are urged to update straight away.
WordPress.org publishes a "Critical PHP Security Release" notice, and security firms report attackers are already trying to use the flaws.
Some government websites are taken offline while they're fixed, which shows how seriously the problem is being treated.
The FBI issues a warning about the two PHP flaws, adding to the calls for website owners to update.
Any website running WordPress, Drupal or Joomla needs PHP updated to a version with the October 21 fixes.
A practice website isn't just a brochure. People share private things through it, and your good name is on it.
People often explain why they're reaching out: their pain, their stress, what's happening at home. On many WordPress websites, those messages are stored on the website itself.
Some practices collect health history, insurance details or injury information through website forms. That's exactly the kind of private health information a break-in could expose, and storing it on a website can raise HIPAA concerns on its own. Intake belongs in your booking or records system.
As a therapist or health practice, you're expected to protect client privacy. A hacked website can also show strange pages or send visitors somewhere harmful, under your practice's name.
If your website runs on WordPress, it needs updating now, and it will keep needing updates. That's not a reason to panic. It is a reason to check today, including what your contact and intake forms ask for and where those messages end up. If you're unsure about HIPAA, check with your compliance advisor.
A WordPress website has software running behind it all the time, like a building with a back door that has to be kept locked. The websites we build are finished pages with only one way in: for your clients.
Today
With Stepflow
Think of a printed menu instead of a kitchen that cooks every page to order. Your pages are finished before anyone visits, so there's nothing to break into.
With no software running behind the website, there's no emergency update to chase when the next security problem makes the news.
Your booking system keeps running exactly as it is, whatever you use. A Book now button on every page takes clients straight to it.
We keep your words, photos and booking link when we move a website over.
No technical skills needed. Try these in order. Most people know after the first or second step.
Type your web address followed by /wp-admin into your browser, for example yourpractice.com/wp-admin. If a WordPress login page appears, your website is on WordPress.
On a computer, open your website, right-click and choose View page source. Press Ctrl+F (Cmd+F on a Mac) and search for wp-content. If it's there, you're on WordPress.
Search emails from whoever built your website for "WordPress", "theme", "plugin" or "Elementor". Any of those is a strong hint.
In WordPress, go to Tools, then Site Health, then Info, then Server. You'll see your PHP version. Ask your web person whether it includes the October 21, 2026 fixes.
Copy this message and send it today.
Hi [name], I saw the news about the PHP2Shell security flaws (October 21, 2026). Can you confirm:
Thanks!
No web person? Or nobody's sure who looks after the website? That's the first thing to fix. Our free website check is a good place to start.
Both are reasonable. What matters is that someone is clearly responsible.
Want the plain-language version to share with your team? Read our blog post, Is my website on WordPress?, or see what's included in every website we build.
We've kept this page to what was reported by the people who make PHP and WordPress, the FBI, security researchers and news organizations. If anything changes, we'll update the page.
Last updated October 24, 2026.
If your site runs on WordPress (or Drupal or Joomla), it uses PHP and needs the October 2026 update. Our free check tells you what your site is built on. Sites we build don't use PHP, so this kind of attack can't reach them.
It is the nickname for two serious flaws in PHP, the software that runs WordPress and many other websites. They let an attacker run their own instructions on a website without a password, so they could read or change anything on it. PHP released fixes on October 21, 2026.
For this problem, if PHP has been updated to a version with the October 21 fixes, yes. But WordPress websites keep needing updates to WordPress, the theme, plugins and PHP. Ask who is responsible for those, and how quickly they act when the next problem appears.
This news is about websites that run on PHP. Your booking system (SimplePractice, TherapyNotes, Jane, Headway or whatever you use) is a separate service, not part of your website. The concern is your practice's own website and anything typed into its contact or intake forms.
It can raise HIPAA concerns. If a form invites people to describe what they're going through, private health information can end up stored on the website or in a generic form tool that hasn't agreed to protect it the way HIPAA expects. We don't give legal advice, so check with your compliance advisor. Our forms ask only for a name, an email and a short message, and keep nothing on the website.
Yes. We keep your words, photos and booking link, and rebuild the website so it doesn't use PHP or WordPress. Start with a free website check and we'll tell you what's involved and give you a clear, fixed quote.
Article
A therapist website with no health information on it isn't the problem. Forms, trackers and tools that collect health details are. How to check yours.
Read itArticle
Many therapist contact forms ask people to describe what they're going through. Why that can raise HIPAA concerns, and what to ask instead.
Read itArticle
PHP released emergency fixes for the PHP2Shell flaws on October 21, 2026. How to tell if your practice's website is affected, and what to ask.
Read itSend us your website. Our free check tells you if it's on WordPress, how it does on phones, and what a new client sees.