Last week, a major cybersecurity vulnerability sent website administrators scrambling to protect their systems. The problem, dubbed PHP2Shell, affects technology that powers a huge portion of the internet, including many websites used by nonprofits, foundations, and businesses.

Some organizations temporarily took their websites offline while emergency fixes were installed. Meanwhile, cybersecurity experts warned that hackers could potentially exploit the weakness to gain access to sensitive information.

The good news? Fixes are available. The bad news? Not every organization knows whether its website is protected.

Here’s what happened, without the technical jargon, and what your organization should be doing about it.

First, What Exactly Is PHP2Shell?

Let’s start with PHP. It’s a programming language that works behind the scenes on millions of websites. Think of it as part of the engine that makes a website function, handling everything from online forms to database connections. Last week, researchers revealed two serious security flaws in that engine. Together, they’re called PHP2Shell.

Here’s a simple analogy: Imagine discovering that millions of buildings have the same defective lock. Under the right circumstances, someone could potentially open any of those doors without a key.

That’s essentially the concern with PHP2Shell. Hackers could exploit these flaws to run unauthorized commands on vulnerable website servers, potentially accessing data, installing malicious software, or disrupting services. And because the problem exists in PHP itself, rather than in any particular website, it affects a remarkably broad range of organizations.

Why Did This Cause Such a Stir?

Three things made this situation particularly concerning.

First, the sheer scale. PHP is used by websites built on popular platforms such as WordPress, Drupal, and Joomla. That means organizations of all sizes could be affected, including those that outsource their website management.

Second, the timing. Details about the vulnerabilities leaked before the planned public announcement, giving potential attackers an early opportunity to investigate the weaknesses. Emergency security updates were released on October 21.

Third, hackers wasted little time. Security researchers detected attempts to exploit the flaws even before the public announcement. By October 26, researchers had confirmed successful exploitation in a monitored environment.

Importantly, this doesn’t mean millions of websites were hacked. Being vulnerable, being targeted, and actually being compromised are three very different things.

Still, the risk is serious enough that organizations shouldn’t wait around to find out which category they fall into.

What Should Your Organization Do Right Now?

You don’t need to understand programming to take the right precautions. You just need to make sure the people responsible for your technology are asking the right questions.

1. Find out whether your website uses PHP.

If your organization uses WordPress or another PHP-based platform, there’s a good chance it does. Ask your IT team, website developer, or hosting provider to confirm whether any of your systems are affected.

2. Make sure the security updates have been installed.

Emergency PHP updates are available, but they must be applied to the underlying server. Simply updating WordPress or its plugins isn’t enough. Your IT provider should verify that the appropriate PHP security fixes are installed and working.

3. Don’t forget about older websites and applications.

That fundraising microsite from three years ago? The old event registration portal nobody remembers maintaining? Those systems could be vulnerable, too. Ask your IT team to check everything your organization has online, not just your main website.

4. Check for signs of suspicious activity.

Installing an update closes the security hole, but it doesn’t necessarily undo damage if someone got in beforehand. Your technology team should review website activity and investigate anything unusual, including unexpected files, unfamiliar connections, or unexplained changes.

5. Confirm who’s responsible for ongoing protection.

If your website is managed by an outside vendor, don’t assume they’ve handled the problem. Ask for confirmation. And use this opportunity to clarify who monitors security announcements, installs updates, and responds when something goes wrong.

A Special Concern for Nonprofits and Foundations

Nonprofits often rely on outside website developers, hosting companies, and small internal IT teams. Sometimes, responsibility for security falls somewhere between those groups. That’s where problems can develop.

A foundation may have excellent cybersecurity protections for its staff computers and Microsoft 365 environment, yet have little visibility into the security of its public-facing website. And that website may connect to donation systems, event registrations, contact databases, or other valuable information.

The lesson from PHP2Shell isn’t that every nonprofit needs its own cybersecurity department. It’s that someone needs to know what technology the organization relies on, who’s responsible for protecting it, and whether critical updates are actually happening.

The Bigger Lesson: Security Isn’t Set It and Forget It

PHP2Shell is another reminder that even widely used, trusted technology can develop serious security problems. The organizations best positioned to handle these situations aren’t necessarily those with the biggest IT budgets. They’re the ones with a clear plan.

That means keeping an inventory of systems, maintaining relationships with reliable technology providers, applying security updates promptly, and knowing what to do when a new threat emerges.

Because when the next major vulnerability makes headlines, the question shouldn’t be, “Are we in trouble?” It should be, “Have we already taken care of it?”

For over forty-three years, CGNET has provided state-of-the-art IT services to organizations of all sizes, across the globe. We’ve done it all, from IT and cybersecurity assessments to cloud services management to generative AI user training. Want to learn more about who we are and how we might be able to help you? If so, check out our website or send us a message!