The PHP2Shell Liability Trap: When a Hacked Website Leads to Court

Two critical vulnerabilities in the PHP runtime—CVE-2026-109618 and CVE-2026-109619, collectively “PHP2Shell”—were actively exploited within 19 minutes of the emergency patch going public. If a client’s site is compromised because nobody upgraded, the first question is not technical. It is legal: who pays, and who gets sued?

What Happened with PHP2Shell

On October 21, 2026, the PHP project shipped emergency releases for two critical remote code execution flaws rated 9.2 on CVSS v4.0. The vulnerabilities live in the PHP interpreter itself, not in a plugin or a theme—meaning even a “well-written” application is exposed if the underlying runtime is unpatched.

CVE-2026-109618 is an out-of-memory state corruption flaw: when memory allocation fails before request data is fully initialized, PHP is left in an invalid state that an unauthenticated attacker can manipulate. CVE-2026-109619 is a use-after-free flaw: request-owned internal state survives after its backing memory is freed, and a later request handled by the same worker can use that stale state before normal initialization resets it. Together, they allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the PHP worker process.

Affected versions include PHP 8.2, 8.3, 8.4, and 8.5 before their respective patches—as well as all versions of PHP 8.1 and earlier, which are already end-of-life and will never receive an official fix. That last point is the legal powder keg.

Why “Nobody Told Me to Upgrade” Is Not a Defense

Courts and regulators do not treat a known, publicly disclosed critical vulnerability the same way they treat an unknown zero-day. Once a patch exists, the standard of care shifts. A professional who fails to apply a patch for a known CVE, or who continues running an end-of-life PHP version that cannot be patched, falls below the conduct expected of a competent professional.

This is not theoretical. The Greek Data Protection Authority fined both a controller (€200,000) and a processor (€150,000) after a breach that succeeded because the processor kept using outdated information systems despite knowing the risks. The authority explicitly held that the processor is not “covered” by the controller—it has its own security obligations and is directly liable for them.

Legal analysts covering PHP2Shell have framed the issue precisely this way: the question is not whether upgrading is optional, but whether an organization can document reasonable security. Prompt patching is evidence of reasonableness; delay or ignorance of whether PHP is even running makes it harder to defend.

The Developer or Agency: Contract Scope Decides Everything

The most common mistake clients and agencies make is assuming that “I built the website” means “I am responsible for keeping it secure forever.” The opposite is also dangerous: assuming “I handed it over” means “I have zero exposure.”

The liability of a developer or agency turns almost entirely on what the contract says. If the agreement includes ongoing hosting management, security maintenance, and update obligations—and the agency failed to apply a patch for a known critical vulnerability that led to the breach—the agency is likely liable. If the client took over the site and the agency only built it, the agency’s exposure is substantially lower.

Two further factors weigh heavily:

• Documentation of warnings. If the agency warned the client in writing that the PHP version was end-of-life and the client refused to authorize the upgrade, the agency has a strong defense. If the agency said nothing, it may share responsibility even if the client “managed” the site. Written warnings significantly reduce liability; a documented client refusal is powerful evidence.
• Liability caps and gross negligence. Many development contracts cap liability at fees paid in the prior 12 months. But courts may void a cap if the conduct rises to gross negligence—and failing to patch known critical CVEs can be characterized as gross negligence, stripping the agency of its contractual shield.

Agencies should carry professional liability (E&O) insurance and, depending on the engagement, a cyber liability rider. Standard E&O policies often cover professional negligence, but some exclude cyber incidents or impose sublimits.

The Hosting Provider: Shared Responsibility, but Not Absolution

Hosting providers are not automatically liable for every vulnerable application their customers run. But they are not immune either—especially when the vulnerability is in the runtime layer that the host controls or influences.

PHP2Shell is particularly awkward for hosts because the flaw sits in PHP itself, not in customer code. Managed hosting arrangements typically promise patch management as part of the service. If a host’s contract says it handles PHP updates and it failed to roll out the emergency release, the host’s exposure is direct. Even on unmanaged plans, hosts that continue to offer end-of-life PHP versions without warning—or that make upgrading unnecessarily difficult—invite regulatory scrutiny and contract claims.

The GDPR analysis is instructive. A hosting provider processing personal data on behalf of a client is a processor. Under Article 28 and Article 32 GDPR, the processor has independent security obligations; it can be fined directly where the cause of the breach is its own failure. The Greek case confirmed this: the processor was fined €150,000 specifically for running outdated systems, and the controller was fined separately for failing to govern the relationship. A host that knew—or should have known—that its infrastructure was running an unpatched, actively exploited PHP runtime cannot hide behind the customer’s configuration choices.

That said, hosts can contractually allocate risk. Well-drafted hosting terms will define patch windows, customer responsibilities, and liability caps. But as with agency contracts, a cap may not survive a finding of gross negligence or willful disregard of a known exploit.

The Client: The Party Most Likely to Be Sued First

Here is the uncomfortable truth for business owners: the client is usually the easiest target. Customers, patients, and users whose data was stolen have a direct relationship with the website owner—not with the developer or the host. Regulators also look first to the data controller, which is typically the client.

Under the GDPR, the controller must implement appropriate technical and organisational measures (Article 32) and must use only processors that provide sufficient guarantees (Article 28). A controller that allowed its site to run an end-of-life PHP version—or that never asked whether PHP was being patched—faces direct exposure. Breach notification duties under Articles 33 and 34 add urgency: delay in assessing whether a breach occurred can itself create separate liability.

In HIPAA contexts, the analysis is similar but the stakes can be higher. A hosting provider that signs a Business Associate Agreement (BAA) and handles protected health information is directly liable for certain Security Rule violations, including failure to implement reasonable safeguards. A covered entity that leaves PHI on an outdated, exploitable platform cannot outsource that liability entirely by pointing to the host.

In the United States, state breach-notification laws and sectoral rules (such as the SEC’s Reg S-P for investment advisers) impose fixed timelines. Vendors may have as little as 72 hours to notify the covered firm, which then has a limited window to notify affected individuals. These deadlines do not pause because the technical root cause is still being investigated.

Cyber Insurance: A Backstop, Not a Strategy

Insurers are watching PHP2Shell closely. AM Best has warned of a significant protection gap between economic losses and insured losses, and carriers are concerned about aggregation risk from a single runtime vulnerability affecting thousands of policyholders simultaneously. Some policies may cover business interruption and incident-response costs; others may exclude or sublimit cyber events.

Critically, failing to patch a known critical vulnerability can jeopardize coverage. Insurers increasingly ask whether insureds run unsupported software, and a negative answer that turns out to be false can create coverage disputes. Cyber insurance is a backstop for residual risk—not a substitute for upgrading PHP.

Practical Allocation of Responsibility

For agencies and developers: Put patch responsibility in writing. If you manage security, document every patch and every client refusal. If you do not manage security, state that clearly and warn the client in writing about end-of-life components. Carry E&O and cyber coverage. Do not assume a liability cap will save you if the failure is characterized as gross negligence.

For hosting providers: Do not silently host end-of-life PHP. Notify customers, provide upgrade paths, and document your patch SLAs. If you promise patch management, treat actively exploited CVEs as emergency work—not routine maintenance.

For clients and website owners: Find out what PHP version your site runs. If it is 8.1 or earlier, you are on an unsupported runtime that will never receive a PHP2Shell fix. Ask your developer and host, in writing, who is responsible for patching. Document the answer. If a breach occurs, engage counsel early so that forensic work can be directed under privilege.

The Bottom Line

When a client’s website is hacked because of an unpatched PHP2Shell vulnerability, the question “who will my client sue?” has an unsatisfying answer: possibly everyone in the chain. The client may sue the developer for failing to maintain security; the client may sue the host for failing to patch the runtime; regulators may fine the client as controller and the host as processor. Contracts, documentation, and the standard of care will determine who ultimately bears the loss—but the one party with the clearest ability to prevent the loss was the one who controlled the upgrade decision.

The patch has been available since October 21, 2026. Exploitation began 19 minutes later. The legal clock started at the same moment.

Disclaimer: This article is for general information only and does not constitute legal advice. Liability outcomes depend on jurisdiction, contract language, and specific facts. Consult qualified counsel in your jurisdiction.