Critical Security Alert for Law Firms: NSA Annoucement
Law firm website security alert: our web developers can help.
Talk to Our TeamUrgent Warning for Lawyers: Law Firm Website Security Alert! Move your law firm website off WordPress now!
The NSA issued its PHP warning on October 21, 2026. Our web developers are available to migrate your firm's website with urgency.
Law Firm Website Security Alert
What the NSA Security Warning Means for Your Law Firm's Website
The NSA warned that websites running vulnerable PHP can be taken over. WordPress runs on PHP, so Dashing Digital Marketing urges law firms to move off WordPress now.
Most Websites Run on PHP. Does Your Law Firm's?
PHP is the most widely used server-side language on the web. According to W3Techs, an independent web technology survey, PHP runs 69.3% of the websites whose server-side language is known, and WordPress powers 39.6% of all websites. W3Techs does not publish a law firm breakdown, but WordPress is built on PHP, so a firm on WordPress sits in the group the NSA warned.
The Short Answer
YES, IF YOUR FIRM'S WEBSITE RUNS ON WORDPRESS. On October 21, 2026, the NSA warned that critical PHP flaws could LET ATTACKERS TAKE OVER A WEB SERVER WITHOUT LOGGING IN, and WordPress runs on PHP. Call your website host today and ask for written confirmation that PHP is patched. If your host cannot confirm it, the NSA recommends taking the site offline until it is fixed. Dashing Digital Marketing also recommends moving your firm off WordPress, and our team can help you do it with urgency.
What Is the NSA's PHP Security Warning, and Does It Apply to My Law Firm's Website?
On October 21, 2026, the National Security Agency issued an advisory about critical flaws in PHP, collectively nicknamed PHP2Shell. PHP is widely used for web applications, and WordPress is built on it.
According to the NSA, an attacker could take over an affected web server without a password or any earlier access. From there, the attacker could steal sensitive data, disrupt the site, or reach deeper into a network.
The NSA says the flaws sit in PHP itself, not in the website software or its settings. A WordPress site with strong passwords and current plugins can still be exposed if its server runs an affected PHP version.
PHP released its patch on October 21, 2026, and the PHP.net Security Advisory page lists current guidance. The NSA warned that cyber actors are likely to weaponize the flaws. Cybersecurity Dive reported that researchers saw exploitation attempts on the day of disclosure.
Is My Law Firm's WordPress Website at Risk From the PHP Vulnerability?
IF YOUR FIRM'S WEBSITE RUNS ON WORDPRESS, IT RUNS ON PHP. That places your site in the group the NSA told to act on immediately.
Your exposure comes down to the PHP update on the server that hosts your site. Many firms cannot say whether that update is installed.
The site may have been built years ago by a freelancer or a former agency, and the hosting account may sit under someone else's name.
Every practice area carries the same exposure. Personal injury, criminal defense, family law, bankruptcy, and estate planning and probate firms all collect client details through the same kinds of contact and intake forms.
Older sites may be in worse shape. The NSA specifically advises replacing end-of-life PHP services that cannot accept the patch. A website running on an outdated PHP version may never receive this fix.
Why Is a PHP Vulnerability a Client Confidentiality Problem for Attorneys?
Your website collects more than most partners realize. Contact forms, consultation requests, and case descriptions often land in a database on that same server.
The NSA noted that these vulnerabilities often provide a direct path to a server's file system or database. Control of the server can therefore mean access to the information prospective clients trusted you with.
That puts your firm's confidentiality duties in play, and the next section explains what the rule asks of you.
A compromised site also harms your reputation. Visitors can meet defaced pages, browser warnings, or spam redirects, and each one carries your firm's name. Strong online reputation management helps after an incident, but preventing the incident is the better path.
Your marketing budget is exposed too. Money you put into digital ads and social media marketing sends people to your website, so a hacked site wastes that traffic.
What Does ABA Model Rule 1.6 Require of a Law Firm When a Website Is Hacked?
Rule 1.6 of the ABA Model Rules of Professional Conduct is titled CONFIDENTIALITY OF INFORMATION. Paragraph (a) bars a lawyer from revealing information relating to the representation of a client. The exceptions are informed consent from the client, implied authorization to carry out the representation, and the situations listed in paragraph (b).
Paragraph (c) is the part that reaches your website. It requires a lawyer to make reasonable efforts to prevent accidental disclosure of client information and unauthorized access to it.
A hacked website is a clear case of unauthorized access. If an attacker takes over the server that stores your contact form submissions, the question that follows is whether your firm made reasonable efforts to prevent it. Information from prospective clients can carry confidentiality duties too, and state rules vary.
The NSA's October 21 warning puts a date on that question. Whether a firm's efforts count as reasonable depends on the facts and on your state's version of the rule, and we are marketers, not ethics counsel. In practical terms, a documented response is easier to defend than silence.
A documented response includes three things:
- Written confirmation from your host that PHP is patched.
- A record of when your firm asked and who answered.
- A dated plan for moving to a platform your firm does not have to patch itself.
Our web developers can supply the technical side of that record.
Why Are WordPress Websites a Security Risk for Law Firms?
A WordPress site is several pieces of software stacked together. The server runs PHP, PHP runs WordPress, and WordPress runs a theme and a set of plugins. Each layer has its own updates, and each one can fall behind on its own schedule.
Falling behind is easy. Updates can break a design or a contact form, so busy firms put them off. A site built years ago by a freelancer may have no one watching it, and one neglected layer is enough to leave a way in.
The 2026 record shows how quickly attackers move.
- In July, BleepingComputer reported that flaws in WordPress core could let a remote attacker run code on a site without logging in. Attacks followed soon after the fixes came out.
- In August, Nigeria's national IT agency warned about a flaw on the WordPress login screen that could lead to code execution, according to Nairametrics.
- In September, the Canadian Centre for Cyber Security reported a WordPress vulnerability exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on September 25.
- On October 21, the NSA warned about the PHP flaws that affect the software WordPress runs on.
An outdated PHP version adds another problem. The NSA advises replacing end-of-life PHP services that cannot take the patch. A site stuck on an old version can stay exposed even when WordPress itself is fully up to date.
Should My Law Firm Move Its Website Off WordPress Immediately?
Dashing Digital Marketing recommends that law firms move off WordPress as soon as a migration can be completed. The NSA has not gone that far. Its formal guidance is to install the PHP update, or to take the system offline if an update is not feasible.
- A WordPress site sits on a server that someone must patch, and the NSA says that patch cannot wait. Researchers reported exploitation attempts on the day the flaws were disclosed. Every new flaw repeats that emergency, and a firm without an IT department may have no one assigned to handle it.
- Older sites may run PHP versions that cannot accept the fix, and the NSA advises replacing end-of-life PHP services.
- WordPress has its own 2026 security record. The Canadian Centre for Cyber Security reported that a WordPress vulnerability was being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on September 25, 2026.
- A managed platform such as Webflow moves server patching to the platform vendor, so the next warning becomes the vendor's job instead of your firm's.
A migration takes time, so protect the current site in the meantime. Ask your host to confirm the PHP update in writing today. If the host cannot confirm it, the NSA recommends taking the system offline until it can be fully mitigated.
Why Does My Law Firm Need to Move Its Website Off WordPress, in Simple Terms?
Think of your website as a house and PHP as the lock on the front door. This week, the makers of that lock released a fix for a flaw that lets burglars get in. The fix is a new lock.
A new lock only helps if it reaches your door. Four things can get in the way.
- Some locks are too old to fix. According to TryHackMe, PHP 8.1 and older versions receive no regular fix from the people who make PHP.
- Someone must install the new lock and test it. Your host has to restart the server and confirm that the version serving your website has the fix.
- The label on the lock can mislead you. Some hosts add the fix without changing the version number, so ask for written confirmation instead of a quoted version.
- Locks wear out. PHP 8.2 stops receiving security fixes on December 31, 2026.
With WordPress, your firm keeps this job forever, and nobody may be assigned to it. A managed platform works like a building where a staff member checks the locks for every tenant. Dashing Digital Marketing's web developers can move your law firm website to Webflow quickly.
What Should a Law Firm Do Today to Secure a WordPress Website After the NSA Warning?
A same-day response follows the steps below. An office manager or managing partner can start the first group without a developer.
In the Next Hour
- Find out who hosts your website and who holds the hosting login.
- Call the host and ask which PHP version your site runs.
- Ask whether that version has the update PHP released on October 21, 2026.
- Ask for both answers in writing today.
If Your Host Cannot Confirm the Patch Today
- Take the site offline until it can be fully mitigated, which is what the NSA recommends when an immediate update is not feasible.
- Put a temporary page in its place with your firm's phone number, so clients can still reach you.
- Call a web developer about moving the site off WordPress.
Once Your Host Confirms the Patch
- Update WordPress core, themes, and plugins.
- Turn on enhanced logging, which the NSA lists as a precaution, and review it for unusual activity.
- Ask whether your PHP version still receives security support, since PHP 8.2 loses it on December 31, 2026.
- Look for signs of compromise, such as unfamiliar pages, unexpected redirects, and changes nobody on your team made.
- Report any signs of compromise to your local FBI field office or the Internet Crime Complaint Center.
This Week
- Write down what you asked, who answered, and when, so your firm has a record of its response.
- Ask Dashing Digital Marketing for a migration review and a launch date.
- Have a developer confirm your forms, redirects, and logins before and after any move.
Is your law firm's website exposed? Tell us who hosts it. Our web developers will tell you what to do next and how fast we can move you off WordPress.
Schedule a CallWhat Should My Law Firm Ask Its Website Host About Security Today?
Your host holds the answer to your exposure, so the phone call comes first. Ask these five questions.
- Which PHP version is my website running right now?
- Has that version received the security update PHP released on October 21, 2026?
- Is that version still supported, or has it reached end of life?
- Can you confirm both answers in writing today?
- What logging exists on my account, and can I review it?
A vague answer from your host should count as a no. A host that needs a week to reply leaves client data exposed for that week.
How Does Dashing Digital Marketing Move a Law Firm Website From WordPress to Webflow?
Dashing Digital Marketing has web developers available to move law firm websites to Webflow with urgency. Webflow hosts the sites on its platform. According to Webflow, it manages the infrastructure and applies patches and updates automatically, so customers do not harden servers or maintain plugins. Webflow also lists SOC 2 Type II among its compliance certifications.
We work only with law firms, so the people handling your move already understand intake forms, attorney advertising concerns, and the way clients search. An urgent migration follows these steps:
- We identify your host, PHP version, plugins, forms, and integrations.
- We confirm your host's patch status and set a launch date as early as your site allows.
- We rebuild your pages, design, and intake forms in Webflow through our website design for law firms.
- We map every existing URL to its new page with a redirect, which helps protect your SEO rankings.
- We set up logins with two-factor authentication and role permissions, since your firm still controls who can edit the site.
- We launch, test the forms, and monitor the new site.
Moving to Webflow takes server patching off your plate. It does not replace good habits such as strong passwords and limited editing access, and we set those up with you.
Redirects, structured data, and page speed fall under our technical SEO services, which protect the search visibility you have built.
Will Migrating My Law Firm Website Off WordPress Hurt My Google Rankings or AI Search Visibility?
A careful migration protects both. Rankings fall when URLs change without redirects, when page titles and headings disappear, or when structured data gets lost. Each of those problems is preventable.
AI answer engines such as ChatGPT and Google's AI Overviews draw from the same pages your site already publishes. Preserving your content, headings, and schema protects your AEO work along with your local SEO results. Keep the answer-ready page structure from our guide to what digital marketing for lawyers looks like intact through the move.
A rushed rebuild by a team that does not understand search can add a second problem to the first. Our team handles security and search together, and you can review our results or run an AI visibility audit before deciding.
What Else Do Attorneys and Office Managers Ask About WordPress Website Security After the NSA Warning?
What is PHP, and why does it matter for my law firm's website?
PHP is a programming language that runs on a web server and builds a web page each time someone visits it. According to the NSA, PHP works on most major operating systems, runs directly on web servers, and can be added into HTML to create dynamic web pages. WordPress is written in PHP, so a WordPress site depends on the PHP version running on its server. Your hosting company often controls that version, which is why your host's answer matters.
Should my law firm move its website off WordPress right now?
Yes. Dashing Digital Marketing recommends moving off WordPress as an urgent priority. The NSA's own guidance is to install the PHP update or take the system offline. We recommend moving because a managed platform takes server patching off your firm's plate. Confirm your host's patch in writing while the migration is underway. Our website design for law firms team can start now.
Is the NSA PHP vulnerability a real threat to my law firm's website?
The NSA considers it serious. On October 21, 2026, it told organizations that use PHP to patch immediately and said cyber actors are likely to weaponize the flaws. A law firm website built on WordPress runs on PHP, so it belongs on your same-day checklist. Your risk depends on whether your host has installed the update. Our website design team for law firms can check it for you.
How do I know if my law firm website uses PHP?
If your site runs on WordPress, it uses PHP, because WordPress is written in that language. Many other website systems use PHP as well. Your hosting provider can tell you the exact PHP version in a few minutes, and a Dashing Digital Marketing web developer can confirm it for you.
Should my law firm take its website offline until PHP is patched?
The NSA recommends taking a system offline only when an immediate update is not feasible. If your host confirms the patch is installed, the site can stay live. If the host cannot confirm it today, taking the site offline until it is mitigated follows the NSA's guidance. A temporary holding page with your phone number keeps clients able to reach you.
Is WordPress still safe for law firms after the NSA warning?
The flaws the NSA warned about are in PHP, not in WordPress itself, so a patched server removes this specific exposure. WordPress has had its own security problems this year, including a vulnerability that the Canadian Centre for Cyber Security reported as exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog in September 2026. We recommend moving off WordPress, because staying requires a named person or vendor responsible for hosting, updates, and monitoring.
What should an office manager ask the website host today?
Ask which PHP version the site runs, whether it has the update PHP released on October 21, 2026, and whether that version is still supported. Request the answers in writing the same day. A vague reply or a delay means the site is not confirmed safe.
Can hackers reach confidential client information through my law firm's website?
The NSA says the PHP flaws could give attackers control of an affected server, which can open a path to files and databases. Forms on your site may store inquiry details in that database. ABA Model Rule 1.6(c) directs lawyers to make reasonable efforts to prevent unauthorized access to client information.
Is a WordPress security plugin enough to protect my law firm's website?
The NSA describes the flaws as being in PHP itself, so the primary fix is a patched PHP version on the server. A WordPress plugin runs on top of PHP and cannot replace that update. Security tools still help with monitoring and logging, which the NSA also recommends.
How long does it take to migrate a law firm website off WordPress?
Timing depends on the number of pages, intake forms, integrations, and content on the site. Dashing Digital Marketing has web developers available to prioritize urgent migrations, and a review of your current site produces a realistic timeline.
How much does it cost to move a law firm website from WordPress to a new platform?
Cost depends on the size of the site, the number of forms and integrations, and how much content needs rebuilding. Dashing Digital Marketing scopes each project after reviewing the current website, so you receive a specific quote instead of a generic range.
Why does Dashing Digital Marketing move law firm websites to Webflow?
Webflow says it manages hosting, applies security patches and updates automatically, and leaves customers with no plugins to maintain. For a law firm, that removes the server patching job that WordPress leaves with you. Your firm still controls logins, so we set up two-factor authentication and role permissions. Our website design for law firms team handles the move.
Will moving my law firm website hurt my Google rankings?
A migration protects rankings when every old URL redirects to its new page, titles and headings carry over, and structured data is rebuilt. Rankings fall when those steps are skipped. Dashing Digital Marketing handles SEO for law firms and AEO, so the migration plan includes both.
What should a law firm do if its website may already be compromised?
Signs include unfamiliar pages, unexpected redirects, browser or search engine warnings, and changes nobody on your team made. The Hill reported that the FBI asks organizations to report signs of compromise to a local field office or the Internet Crime Complaint Center. Contact your host and a web developer right away.
The Bottom Line
The NSA warning turns a routine website question into a same-day task. Ask your host today whether PHP is patched, and insist on a written answer. Then start your migration, because a firm on a managed platform no longer carries server patching alone. Our web developers are ready to begin now.
Security belongs inside a larger digital marketing strategy for law firms, and firms that want senior guidance across it can work with a fractional chief marketing officer.
April Atwater, President, Dashing Digital Marketing
As a digital marketing expert with 22 years of experience specializing in search strategy and digital presence, April is an expert at Architecting Digital Authority. She brings a deep understanding of the complexities of working in highly regulated industries, including law, which makes her a trusted ally for professionals navigating the digital landscape. April focuses on helping law firms and attorneys architect their digital authority to become the primary recommendation across both traditional search platforms and AI discovery engines. Her writing on AI visibility has appeared in Arizona Attorney Magazine, the Wyoming Lawyer, and The Iowa Lawyer.
