This content was originally published in our property management newsletter, Pillow Talk. Sign up here.
On Wednesday, October 21, a pair of critical flaws in PHP were made public, and I think every property manager should spend five minutes on them this week.
A little context on why I’m writing it. I grew up in the cybersecurity world: I wrote my first anti-hacking tools at 16, and later led architecture and innovation at a major cybersecurity company. I’m not a CISO and this is not a security audit. It’s the advice I’d give a friend who runs a PM company.
What is PHP2Shell?
PHP is the language behind most of the web, including every WordPress site. On October 21, PHP released fixes for two flaws, nicknamed PHP2Shell, that let an attacker take over a web server without a password or a login. They are rated 9.2 out of 10.
The NSA and CISA both put out warnings. This is what the NSA posted on X:
Its full advisory, published with the fix, is blunter: patch now, and if you can’t, take the system offline until you can. Within a day, security companies were already seeing attack attempts.
Why a PM should care
Your website isn’t just a brochure. For many PM companies it’s where the rental application lives, where owners log in, and where leads land. Those forms collect names, phone numbers, sometimes Social Security numbers and bank details. A server someone else controls can quietly copy all of it, or swap your “apply now” link for theirs.
Am I affected?
| Your website is… | What to do |
|---|---|
| WordPress, or built by a freelancer or agency | Ask whoever manages it whether it runs on PHP (every WordPress site does). If it does, send the email below today. |
| Wix, Squarespace or another hosted builder | The platform handles the server. Nothing to do for PHP2Shell. |
| A portal or web page a vendor runs for you (owner portal, tenant portal, application page) | Probably not PHP, but it’s public, it carries your name and it holds your clients’ data. Ask the vendor the three questions below. |
| Built it yourself with AI (vibe coding) | Most likely safe, since AI builders rarely use PHP. To be sure, share this post with the AI you built it with and ask: “Does my site use PHP or WordPress, and do I need to do anything about PHP2Shell?” |
| Not sure | That’s step one. Forward the email below to whoever manages it. |
Do this today: copy, paste, send
Copy the email below and send it to whoever manages your website:
Subject: Please update our website for the PHP security issue
Hi,
The NSA and CISA have warned about a critical security flaw in PHP, the language WordPress and many websites run on (NSA advisory: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/). Two popular WordPress plugins, UpdraftPlus and Rank Math, were also compromised this month.
Could you please: 1. Update PHP to the patched version. 2. If we use UpdraftPlus or Rank Math, follow their security instructions. 3. Make sure WordPress and all our plugins are up to date.
Let me know once it's done.
Thanks!
And for every vendor that holds your data
You vet your plumbers, your roofers and your HVAC techs before you send them into an owner’s property. The vendors running your website, your portals and your forms deserve the same question: who are they, and who checks their work? They carry your name, and more important, your owners’ and residents’ data.
Three questions are worth asking each of them once a year:
- When was your last independent security audit?
- How do you find security problems before an update goes live, and how fast do you patch?
- If you’re breached, how quickly will you tell us?
A good vendor answers in a day without blinking. A vague answer is the answer.
Since we’re a vendor too, here are our answers:
- Audited. In June, an independent security lab tested Blanket against the App Defense Alliance standard, the same bar Google sets for apps that connect to Gmail. We passed on the first submission.
- Checked on every change. Every update we make is scanned before it goes live: our own code, and every outside software package it’s built on. On top of that, we test the live platform from the outside, the way an attacker would.
- Locked, backed up, and upfront. Your data is encrypted both when it travels and when it’s stored, and it’s backed up every day. If a breach ever touches your data, we’ll tell you within 24 hours. And anyone who finds a security issue can report it to us directly through our security policy.
Ask us the same questions anytime. We’d rather you did.
One last thought
October felt like chaos: more than a dozen major security incidents at well-known software companies in three weeks, PHP2Shell among them. And it will get faster. PHP2Shell was found with the help of AI, and the same tools that help researchers find holes will help attackers too. The upside is that it forces everyone, vendors included, to get faster at fixing them. The companies that adapt fastest are the ones still standing, and that’s who you want holding your data.
Liked this one, or want me to go deeper on any of it? Write to me at sagi@blankethomes.com. I read every one :)
Sources
- NSA advisory
- CISA alert
- NSA on X
- Wiz: how AI helped find PHP2Shell
- Rank Math PRO compromise (BleepingComputer)
- UpdraftPlus breach (Search Engine Journal)
