PHP Flaw: Is My Healthcare Site at HIPAA Risk?

Does the PHP vulnerability put my healthcare website at HIPAA risk?

It can, if your site handles patient information and runs an unpatched PHP version. The flaw is in PHP itself, not in your site's code, but a practice is still expected to find and fix known risks to patient data. Whether this creates a HIPAA problem for you depends on what your site does and how fast it is patched.

The flaws, called php2shell, were announced on October 21, 2026. Our plain-English summary is in php2shell: What the PHP Flaw Means for Your Website.

Which parts of a healthcare website are affected?

Anything that collects or shows patient information and runs on PHP is worth a look. On a typical practice site that means patient portals, online intake forms, appointment booking plugins, contact forms that ask about symptoms, and any WordPress plugin that stores submissions. A simple brochure page carries less exposure.

WordPress runs on PHP, and so do most of the plugins used for forms and booking. The flaw is in the server software those plugins sit on. The WordPress.org statistics feed shows about 34 percent of WordPress sites still on PHP 8.1 or older (our calculation from the feed on October 27, 2026), and those versions no longer get regular security updates. Ask where patient data lands: your website, a separate portal, or an outside service.

What does the HIPAA Security Rule require?

The Security Rule requires covered entities and their business associates to run a risk analysis of systems holding electronic patient information, and to act on what it finds. It does not name PHP or set a patch deadline today. A known, serious flaw on such a system is the kind of risk the analysis should catch.

In practice, that means writing down which systems hold patient data, noting that a critical PHP flaw exists, recording the fix and the date it was applied. If your website vendor hosts or processes patient data for you, they may be a business associate, which calls for a signed agreement. Your compliance lead or counsel should confirm how this applies to you.

Has HIPAA enforcement ever involved unpatched software?

Yes. The US Department of Health and Human Services Office for Civil Rights (OCR) has settled cases tied to out-of-date software. One example is a $150,000 settlement with Anchorage Community Mental Health Services, titled "Vulnerability of Unpatched and Unsupported Software" (page reviewed December 2014).

That case is old, and it is not about PHP. OCR has also settled four ransomware investigations for a combined $1,165,000, covering breaches that affected more than 427,000 people (HHS announcement). Read these as signals of what regulators look at, not predictions about any one practice. The Anchorage details are on the HHS resolution page.

Is there a new federal deadline for patching?

Not yet. In January 2025 HHS proposed updating the Security Rule. The proposal would require a written patch policy, with critical-risk patches applied within 15 calendar days and high-risk patches within 30. It is a proposal only. It is not law, and it may change before any final rule.

The proposal was published in the Federal Register on January 6, 2025. The federal rulemaking agenda lists a final action as long-term, with a target of July 2027 (Unified Agenda entry). Even so, many practices adopt timelines like these now, because they are a reasonable standard to be measured against.

What about PCI DSS if my site takes payments?

If your site takes card payments, the PCI DSS standard applies. Requirement 6.3.3 in version 4.0.1 expects critical and high-severity security patches to be installed within one month of release. We read this in secondary summaries, since the standards body's own PDF would not load for us, so confirm the wording with your payment processor.

The summaries we reviewed are from Daydream and PCI DSS Guide. Many sites reduce their scope by sending customers to a hosted payment page, so ask your processor which requirements apply to you.

What should I ask my web vendor?

Ask your web vendor five questions and request the answers in writing. They keep the conversation factual and give you a record for your risk analysis. None of them needs technical knowledge to read the reply, and a vague answer tells you something too.

• • What PHP version does my site run today, and on which host?
• • Has it been updated to a version that fixes CVE-2026-109618 and CVE-2026-109619? On what date?
• • Does my site collect patient information, and where is it stored?
• • Do you sign a business associate agreement, and who patches the server?
• • What is your timeline for critical patches in future?

You can check the version yourself first with our free PHP version checker.

How can Cuanto Labs help?

We check your PHP version, update it with your host, test forms and booking tools afterward, and give you a short written record of what was done and when. For WordPress sites we also review plugins and access. See WordPress security for the scope and pricing.

We are a development firm, not a law firm or a compliance auditor, so we do not certify HIPAA or PCI compliance. We supply the technical facts your compliance lead or counsel needs. To talk through your site, book a call.

Next step

Start with the version check, then send the five questions above to your vendor. If the answers are unclear or the site runs PHP 8.1 or older, book a call.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.