PHP2Shell for Nonprofits and Associations

As of 23 October 2026, the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, attackers are widely reported to be trying them, and no confirmed successful break-in has been publicly documented. If your nonprofit's or association's website runs on WordPress, Drupal, Joomla or another PHP system, someone has to make sure the PHP on its server is updated and restarted. Usually that someone is your web host. Your job is to find out who it is and get a clear answer from them.

For most small organizations this takes one email, not a technical project. The hard part is often finding who holds the hosting login. It may be a volunteer, a board member, a former staff member or an agency you stopped working with years ago.

This guide covers what nonprofits and member associations need to do: find the people, get the confirmation, check donation and membership tools, and use the free help available to civil society groups. For a plain explanation of the flaws themselves, see what PHP2Shell is.

What's at Stake for a Nonprofit

A nonprofit's website is often its donation page, volunteer sign-up, event registration and public voice at once. A compromised site can mean altered donation forms, stolen donor or member details, or a site that sends visitors to scams under your name. For organizations that rely on public trust, that cost lasts longer than the cleanup.

There is no reliable data on how nonprofits specifically fare. Verizon's 2026 Breach Impact Study, based on about 70,000 cyber insurance claims, puts the median financial impact for small and mid-size businesses (under $25 million in revenue) at about $38,000. It does not break out nonprofits, so treat that figure as a rough guide by budget size only. Verizon's 2026 Data Breach Investigations Report found that exploiting vulnerabilities was the most common way attackers got into small businesses, at 26% of breaches. PHP2Shell is exactly that kind of vulnerability.

Step One: Find Out Who Runs Your Website

Before anyone can patch anything, you need three names: who controls the domain, who controls the hosting account, and who maintains the site. In small organizations these are often different people, and sometimes nobody.

If you find the account, make sure at least two trusted people in the organization can get into it, and turn on two-factor sign-in. Our guide to access control and 2FA explains how. Many small-organization site problems trace back to logins held by one person who has moved on.

The One Email Most Organizations Need to Send

If a host runs your server, send something like this to their support team:

Subject: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on our account
Hello, our website is [site address] on account [account name or number]. Please confirm in writing: (1) whether PHP on our plan is managed by you or by us; (2) that the PHP serving our site includes the fixes for CVE-2026-109618 and CVE-2026-109619, and how you confirmed it; (3) that PHP workers were restarted after the update; (4) whether session upload progress is switched off, as PHP advised on 23 October 2026. Thank you.

Keep the reply. Most large managed hosts have said publicly that they patched without customer action, but an answer about your plan is worth more than a status page. Our guide to asking your host explains how to read the answers, including why the version number alone can't prove anything.

Volunteer-Run Sites: What to Do and What to Avoid

Volunteers keep many organizations online, and they are often the people who will step up this week. A few ground rules help:

• Patch PHP, not WordPress. No plugin can fix this. A security plugin runs inside PHP, so it can't patch the PHP engine itself.
• Don't run exploit or "checker" code from GitHub. Bitdefender reports that "several GitHub repositories claim to host proof-of-concept (PoC) exploits," that some are pranks, and that teams should "treat every unofficial PoC as untrusted code."
• Don't turn off PHP to take the site down. If the site must go offline, use the host's maintenance mode or ask the host to block access. Beazley Security warns that disabling the PHP handler "can expose application source code and credentials."
• Write down what you did. A short note with dates, who did what and what the host said will help the next volunteer, your board and your insurer.

If the volunteer manages the server directly, our WordPress and PHP2Shell guide walks through the server-side steps. If nobody on your team can do it, our emergency PHP patching service can.

Donation, Membership and Event Platforms

Many organizations take donations or manage members through a hosted service, sometimes connected to the website with a plugin or an embedded form. Those services patch their own servers, but you should ask, because you are accountable to your donors either way.

Some platforms have published their position. BigCommerce says it "applied emergency patches across all services." HubSpot says "PHP is not part of HubSpot's infrastructure." Webflow says its "core services are not built on PHP and are not affected." Look for a similar statement from each vendor you use, and ask if there isn't one:

1. Does any part of your service, including admin and donor portals, run on PHP? If so, is it patched and restarted?
2. Have you seen any sign of exploitation since 17 October 2026, the earliest reported attempt?
3. Could our donor, member or payment data have been exposed, and how would you notify us?
4. Does the plugin or connector on our website store API keys, and should we rotate them?

That last question matters because a connector plugin runs on your website's server, not the vendor's. If your site was on unpatched PHP and something looks wrong, rotate the keys those plugins hold. One PHP2Shell path can leak server memory, which researchers at Wiz say "may contain passwords, authentication tokens, API keys and certificates." Our vendor security review guide has a fuller set of questions for the long term.

Free Help for Nonprofits

• CISA for civil society: CISA says it "is committed to advancing the digital security of civil society organizations and other high-risk communities," with a series of "how-to" labs. See CISA's high-risk communities page.
• CISA for small organizations: free guidance and its "Secure Your Business" material on the small and medium business page, plus a list of no-cost services and tools.
• Protect.ngo: the CyberPeace Institute now goes by Protect.ngo, and its old address redirects there. It says: "Nonprofits are under attack Our cyber volunteers defend them." See protect.ngo.
• NIST Cybersecurity Framework 2.0: NIST says CSF 2.0 is "designed for all audiences, industry sectors and organization types, from the smallest schools and nonprofits to the largest agencies and corporations." It is a useful structure once the emergency is over.

If Something Looks Wrong

Signs worth a closer look include new administrator accounts, changed donation or contact forms, pages you didn't create, redirects to other sites, or a warning from your host. Look back to at least 17 October 2026. Our guide "was my site hacked?" lists what to check and when to bring in help.

Before anything is wiped or rebuilt, ask the host to keep copies of the logs. Restore only from a backup you know is clean; our backup and recovery guide explains how to choose one. If donor or member personal data may have been taken, state breach notification laws may apply. NCSL keeps a list of them, though its page was last updated in January 2022, so check your state's current law. This is general information, not legal advice.

Conclusion

For most nonprofits and associations, PHP2Shell comes down to finding who runs the website, getting a clear written answer that the PHP fix is in place, and asking the same of the platforms that handle donations and members. The organizations that struggle are the ones where nobody holds the keys, and fixing that pays off long after this week. If your organization needs help confirming a fix or securing a site for the long term, our website security team can help. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions