Yesterday the New York State Department of Financial Services sent an alert to every business it regulates. Insurance agencies, mortgage companies, banks, everybody. It is about two critical vulnerabilities in something called PHP.

I have had this question four times since the alert went out, phrased almost the same way each time: does this have anything to do with me?

Probably, yes. Here is the plain version.

What DFS actually sent

The alert is dated October 22, 2026, addressed to DFS-regulated entities. It names two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and says they could allow unauthenticated remote code execution and unauthorized access to server files and databases.
Strip the language out of that and it means: an attacker who has no password, no account and no relationship with you can tell the server to run their commands, and read what is on it. They do not have to break in. They ask, and it answers.
Security researchers have been calling this one PHP2Shell. Both flaws are rated 9.2 out of 10. The patched versions came out on October 21.

What PHP is, and why you probably have it

PHP is a programming language that runs websites. Not the part you see — the part underneath, on the server, that builds the page before it reaches the visitor.
If your agency website runs on WordPress, it runs on PHP. WordPress alone is roughly four in ten websites on the internet. Beyond that, plenty of client portals, quote forms, document-upload pages and older line-of-business web tools are built on it too.
So the honest answer for most agencies is: you almost certainly have PHP somewhere, and nobody inside the agency knows it, because nobody inside the agency built the website.

The four things DFS asked for

I am going to translate these, because they are written for a bank's security team and read that way.

1. Find it. DFS says determine whether PHP is used across your organization, including internet-facing applications — and coordinate with third-party service providers to confirm whether they have remediated. Read that second half twice. DFS is explicitly saying your vendor's exposure is your problem to go ask about.

‍2. Patch it immediately. Prioritize anything facing the internet. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you are on PHP 8.1 or older, there is no fix coming for you. That version is end of life. Your only move is to upgrade.

‍3. If you can't patch it, take it offline. DFS says that plainly, and adds something worth noticing: a web application firewall may help against some attack paths but is not a substitute for patching or isolation. That line exists because somebody always says "we have a firewall."

‍4. Watch the logs. Look for unexpected PHP processes launching shells, running commands or pulling down tools. Which raises the obvious question — who is reading your logs, and would you know if nobody was?

The part that is actually about you

Here is what I want an agency owner to take from this, because the patching itself is not your job.
Step one of that DFS list is an inventory question. Do you know what you have, and who touches it? And the website is the single most common thing missing from an agency's inventory. It was built years ago, by a marketing company or a nephew or a vendor that has since been acquired. Somebody pays the hosting bill. Nobody owns it.
It sits on the public internet with your name on it, a contact form collecting client information, and often a login. And when DFS says coordinate with your third-party service providers, that is the provider they mean.
This is the same thing DFS wrote about on September 10, in its guidance on cybersecurity risk assessments: incomplete asset inventories, and client data nobody traced. That letter described the gap. This alert is what the gap looks like on a Tuesday.

Four questions to send your web host today

You can forward this list. You do not need to understand the answers — you need to get them in writing, dated, because in April you sign your name to a certification and the records behind it have to exist.
‍
1. Does our site run on PHP, and which version?
2. Have you applied the October 21, 2026 PHP security updates (8.5.12, 8.4.27, 8.3.36 or 8.2.35)?
3. If not, when, and what are you doing in the meantime?
4. Who is monitoring that server for exploitation, and how would we be told?

‍If the reply comes back as "we're all set" with nothing dated attached, you have not got an answer. You have got a reassurance. There is a difference, and DFS examiners know it.

What this does to your risk assessment

Part 500 has required a cybersecurity risk assessment since 2017, and it requires that the assessment be updated when something materially changes your risk. Your program is supposed to be built on it.
A critical, actively targeted vulnerability in a system holding your client data is exactly the kind of thing an assessment is supposed to have anticipated — by having the asset on the list in the first place. If your website is not in your inventory, your assessment did not account for it, and this week is the proof.
Every April 15th you sign a certification of material compliance. You cannot certify what you cannot produce.

Where Motiva is on this

We saw the alert when it went out. For the agencies and mortgage companies we support, this is already handled — identification, patching where it is ours to patch, and the vendor coordination where it is not.
If you are not a client and you want someone to read your web host's reply and tell you plainly whether it is good enough, write to info@motiva.net. I will tell you what I see. If it holds up, I will say so.
And if you would rather start further back — with whether your risk assessment is a real one or a piece of paper — that is at motiva.net/risk.

— Walter

SEC & FINRA EXAM READINESSP.S.‍
Think you're covered? Find out if you're exam-ready.
Your IT may be working. Your examiner may still find gaps. Get a free SEC/FINRA Exam Readiness Review and see what your firm can actually prove — from documentation and access reviews to training records and supervision.
Get My Exam Readiness Review →