PHP2Shell: A Risk You Should Take Seriously This Week
Your website is the most public part of your credit union. Members use it to check rates, find branch hours, apply for loans, and open accounts. A hosting company or web developer usually runs it, and it rarely comes up at the board table. A newly disclosed flaw in PHP, the software behind much of the web, is a good reason to change that this week. This applies to both federal and state-chartered credit unions.
What Happened
On October 21, 2026, the PHP development team released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which together are being called "PHP2Shell." Both are rated 9.2 out of 10 and could let an attacker run code on a web server without logging in. Researchers demonstrated the attack on WordPress, Drupal and Joomla, which are common platforms for credit union websites.
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4 through 8.1 have limited source code fixes, and versions older than 7.4 get no fix from the PHP project. PHP says updating is the only complete fix.
Where Exploitation Stands
As of October 21, attackers are trying to use these flaws, but no confirmed break-ins have been publicly reported. Cloudflare reported early attacks emerging, and watchTowr observed exploitation attempts against both flaws. Neither flaw had been added to CISA's Known Exploited Vulnerabilities catalog, and no compromise had been confirmed. CISA has still urged organizations to patch immediately. Treat the lack of confirmed compromises as a short window to act, not a reason to wait.
Why It Matters
This isn't only an IT ticket. It touches member trust, fraud exposure, vendor oversight, and regulatory obligations, all of which belong to management and the board.
Your website collects sensitive data. Online loan and membership applications often capture Social Security numbers, income, employment, and identification details. If the server behind those forms is compromised, that information may be exposed even though your core system was never touched.
A compromised website can be used against your members. An attacker who controls your site can change what members see. That could mean a fake login page, a changed phone number for "fraud support," or a link that sends members to a look-alike site. Members trust your web address, so these schemes can work well, and the losses and complaints land on you.
Downtime is a member service issue. If your vendor has to take the site offline to patch or investigate, members lose access to rates, forms, applications, and possibly links to online banking. Your call center and branches should know what to say.
You own the risk even when a vendor runs the system. Many small credit unions rely on one web developer or hosting company with little written detail about security updates or incident notice. Regulators expect you to oversee those relationships. "Our vendor handles it" is only a defensible answer if you can show you asked and documented the response.
A reporting clock may start without warning. If a vendor tells you your site or data was affected, a regulatory reporting deadline may already be running. Leadership needs to know who decides whether an event is reportable and who files the notice.
Older systems can't simply be patched. If your site runs on an unsupported PHP version, fixing it may mean a platform upgrade with real cost and timing. That's a budget and priority decision, not just a technical one.
What Leadership Should Do Now
Share this article with your IT team immediately. The news of the vulnerability is not wide-spread yet, don’t assume your IT team or provider is aware of the risks.
Get a short inventory. Ask for a list of your website, online application portals, forms, and other internet-facing tools, and who manages each one.
Require written vendor answers. Ask each provider whether they use PHP, whether they've applied the October 21 updates and when, and whether they've checked for signs of compromise.
Escalate unsupported versions. If any system runs PHP 8.1 or earlier, ask for the upgrade plan, cost, and timeline. Until it's fixed, it should be isolated from public networks.
Name the decision-maker. Confirm who decides whether an event is reportable, who files the notice, and which regulators apply to your charter and insurance type.
Prepare member-facing staff. If the site goes down, branch and call center staff need a short script and an alternate way for members to get help.
Report to the board. Give a brief update on exposure, vendor responses, and any open items.
Reporting to NCUA
If your investigation into this vulnerability confirms or establishes reasonable belief that a reportable cyber incident occurred, report the incident to NCUA.
What Counts as a Reportable Cyber Incident
For federally insured credit unions, NCUA's rule starts with a broad definition. A cyber incident is any event that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of an information system or the information on it. Only a substantial cyber incident is reportable, and only if it leads to one or more of these outcomes:ncua+1
A substantial loss of confidentiality, integrity, or availability of a network or member information system that results from unauthorized access to or exposure of sensitive data, disrupts vital member services, or has a serious impact on the safety and resiliency of operational systems and processes.
A disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities.
A disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise.
NCUA has also said what is not reportable: blocked phishing attempts, failed attempts to gain access, unsuccessful malware attacks, routine maintenance or system updates, and penetration tests you asked a third party to run. The third outcome applies only to third parties that have a relationship with your credit union. A breach at an unrelated company that happens to hold your members' information doesn't trigger it.
Each event depends on its facts, so document your reasoning either way.
Timing and How to Report
Federally insured credit unions must notify NCUA no later than 72 hours after reasonably believing a reportable incident occurred. For third-party incidents, the clock starts when the vendor notifies you or when you form that belief, whichever comes first. The notice is an early alert, and you don't need a full assessment before you file.
You can report through NCUA's online reporting form, by calling 1.833.CYBERCU (1.833.292.3728), or by secure email to cybercu@ncua.gov. Be ready to provide your credit union's name and charter number, the reporter's name, title, and contact information, when you reasonably believed the incident occurred, and a basic description of what was affected.
State-Chartered Credit Unions
Federally insured state-chartered credit unions follow NCUA's rule and should also check their state regulator's requirements, which may set their own definitions and timing. For example, New York requires covered entities to notify the state within 72 hours after determining a cybersecurity incident occurred, including incidents at third-party service providers. Privately insured state-chartered credit unions aren't covered by NCUA's rule. Their requirements come from the state regulator and any terms set by the private share insurer.
For every charter type, state breach notification laws may also require notice to affected members if their information is exposed.
Bottom Line
A website flaw can turn into a member data, fraud, and regulatory reporting issue within hours, and the accountability stays with your credit union even when a vendor runs the system. Get written answers from your vendors this week, know what makes an event reportable, and make sure someone has clear authority to make that call. If it would help, Crimson Oak Strategies can help you organize vendor follow-up or work through a reporting decision.
Crimson Oak Strategies provides strategic compliance support and guidance tailored to credit unions. Our mission is simple: To make compliance practical. Contact us to learn how we can help.
