The PHP Cyberattack Crisis: What Law Firms Need to Know to Protect Client Data

A prospective client fills out your firm's online intake form at 11 p.m. They describe their case, upload medical records, and type in their phone number. That form runs on PHP. So does the WordPress site hosting it, the plugin processing it, and very likely the server delivering it. If that PHP installation is unpatched, a criminal on another continent may be able to run code on your web server without a password, without phishing anyone, and without touching your office network first.

Direct answer: The "PHP cyberattack crisis" refers to the mass exploitation of critical vulnerabilities in PHP, the programming language that powers the majority of law firm websites, client intake portals, and contact forms. The most urgent example is CVE-2024-4577, a critical remote code execution flaw in PHP on Windows servers that has been under widespread, automated attack since 2024 and into 2025, including by ransomware groups. Law firms are exposed because their websites and intake forms are internet-facing by design and often run on outdated PHP versions managed by third-party hosting providers. The practical response is to identify every PHP-based system the firm relies on, confirm it runs a supported and patched PHP version, harden and monitor the web server, and have independent testing verify the result.

This guide is for managing partners, firm administrators, marketing directors who "own" the firm website, and the IT providers who support them. It is educational cybersecurity information, not legal advice. It draws on reporting and advisories from Cisco Talos, GreyNoise, BleepingComputer, the California Cybersecurity Integration Center, and Fortinet FortiGuard Labs, alongside ABA Model Rule 1.1, ABA Model Rule 1.6, and ABA Formal Opinions 477R and 483.

Why PHP matters to every law firm, even firms that "don't do tech"

PHP is the server-side programming language behind WordPress, the content management system that powers a large share of the public web, including most small and mid-size law firm websites. When your marketing site, your blog, your "Contact Us" form, or your client intake portal runs on WordPress, Drupal, Joomla, or a custom-built legal intake tool, PHP is almost certainly executing underneath it.

This matters for three reasons:

• It is internet-facing by design. Your website exists to be reached by strangers. Every PHP page is a door an attacker can knock on from anywhere in the world, around the clock, without social engineering a single employee.
• It handles confidential submissions. Intake forms collect exactly the information a firm is ethically obligated to protect: names, facts of a case, medical details, financial information, and sometimes documents uploaded before an engagement even exists.
• It is usually someone else's job. The firm website is typically built and hosted by a marketing agency or a low-cost hosting provider. Nobody at the firm knows what PHP version is running, when it was last patched, or whether the server is shared with hundreds of other customers.

That combination, a universally reachable system holding sensitive data that nobody actively maintains, is what makes PHP an ideal target.

CVE-2024-4577: the flaw at the center of the crisis

In June 2024, PHP maintainers patched CVE-2024-4577, a critical argument-injection vulnerability affecting PHP running in CGI mode on Windows servers. The flaw allows an unauthenticated attacker to inject options into the PHP binary by abusing a Windows character-encoding behavior, which can expose source code or let the attacker execute arbitrary PHP code on the server. In plain terms: for affected configurations, a stranger can send a crafted request to your web server and run their own code on it.

What happened next is why this became a crisis rather than a routine patch:

• Exploitation began within days. Proof-of-concept exploit code was published roughly a day after the patch, and honeypot networks observed exploitation attempts almost immediately, according to BleepingComputer.
• Ransomware groups adopted it. The TellYouThePass ransomware gang used CVE-2024-4577 to plant web shells and encrypt victim systems, and multiple malware campaigns, including remote access trojans and cryptominers, followed, per Fortinet FortiGuard Labs.
• The attack surface was enormous. Censys observed roughly 458,800 potentially vulnerable PHP servers within days of disclosure, as cited in the FortiGuard report.
• Exploitation went global and stayed active. Cisco Talos documented a campaign using the flaw against organizations in Japan beginning in early 2025, and GreyNoise then confirmed mass exploitation far beyond Japan, with spikes in the United States, the United Kingdom, Singapore, and Germany. In January 2025 alone, GreyNoise honeypots recorded more than a thousand unique IP addresses attempting to exploit the flaw.
• Government cyber centers issued public warnings. The California Cybersecurity Integration Center advised organizations to upgrade PHP immediately, noting that ransomware groups had used the flaw to deploy web shells and encrypt systems.

The Talos post-exploitation findings are the part law firm leadership should sit with. After gaining access through the PHP flaw, attackers moved through victim networks, escalated privileges, erased event logs to hide their tracks, and dumped passwords and credential hashes from memory, as described in the Talos campaign reporting. A compromised web server is not the end of the attack. It is the beginning.

CVE-2024-4577 is the headline, not the whole story

Fixating on a single CVE misses the structural problem. PHP risk for law firms comes in layers:

1. Unsupported PHP versions. Every PHP version eventually stops receiving security fixes. Versions such as PHP 7.4 and 8.0 are end-of-life and receive no security patches at all, and older 8.x releases age out on a published schedule. A firm whose host still runs an end-of-life PHP version is permanently exposed to every vulnerability discovered after support ended. You can check which versions are still supported on the official PHP supported versions page.

2. Vulnerable plugins and themes. On WordPress, most compromises do not come from core PHP at all. They come from out-of-date plugins and themes: the contact-form plugin, the appointment-booking widget, the slider the agency installed in 2019. Each is PHP code written by a third party, running with full access to your site and its database.

3. Abandoned custom code. Many firm sites were custom-built by an agency and never touched again. Custom PHP written years ago frequently contains injection flaws, file-upload weaknesses, and exposed administrative endpoints that no scanner-for-hire ever reviewed.

4. Shared hosting exposure. Budget hosting places your firm's site on the same server as hundreds of unrelated sites. A compromise of a neighboring site can, in poorly isolated environments, become a compromise of yours.

5. Exposed error pages and configuration. Misconfigured PHP can leak version numbers, file paths, database credentials, and stack traces through error messages, giving attackers a roadmap for free.

What a compromised law firm website actually costs

It is tempting to dismiss the firm website as a brochure. Attackers know better. A compromised PHP server can be used to:

• Steal intake submissions. Every prospective client's name, contact details, and case description sitting in a form plugin's database is readable by whoever controls the server.
• Redirect payments. Criminals who control your site can alter published payment instructions, clone your payment page, or intercept invoice emails, the same mechanics behind the wire transfer fraud and fake escrow instruction schemes that cost firms and their clients six figures per incident.
• Impersonate the firm. A hijacked site can host convincing phishing pages under your own domain, lending your firm's name and reputation to scams aimed at your clients, similar to the email spoofing and attorney impersonation campaigns already targeting the legal industry.
• Pivot inward. If the web server can reach anything else, a document share, a practice management integration, an internal VPN endpoint, the attacker follows the same escalation path Talos documented: credentials, persistence, lateral movement.
• Distribute malware to visitors. Clients and referral partners who trust your domain become targets themselves, multiplying reputational and potential liability exposure.
• Seed ransomware. TellYouThePass and similar groups do not negotiate over brochures. They encrypt whatever the compromised server can reach and extort the organization.

The ethics and regulatory dimension

A website breach at a law firm is not merely an IT problem. It implicates professional duties that attach regardless of how small the firm is or who hosted the site:

• ABA Model Rule 1.1 (competence) includes a duty to understand the benefits and risks of relevant technology. A firm that cannot say what software runs its website or when it was last patched will struggle to show that duty was met.
• ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to client information. Intake submissions from prospective clients deserve protection too, and confidentiality obligations can attach before a formal engagement.
• ABA Formal Opinion 477R addresses securing client information when communicating electronically, and Formal Opinion 483 addresses lawyers' obligations after a data breach, including the duty to notify affected current clients.
• The FTC Safeguards Rule applies to law firms that engage in covered financial activities, such as firms whose work involves certain real estate settlement or financial advisory functions. For those firms, periodic risk assessments and vulnerability management are not optional best practice; they are regulatory expectations. Coverage is fact-specific, so confirm your firm's status with counsel.
• State breach notification laws may be triggered when intake submissions or client data are exposed, with notification clocks that start running on discovery.
• Cyber insurance applications and renewals increasingly ask pointed questions about patch management, end-of-life software, and web application testing. An "I don't know, the agency handles it" answer can jeopardize coverage at the moment you need it.

For a fuller picture of how these duties fit together, see our law firm cybersecurity checklist and our guide to website security and web application penetration testing for law firms.

How to tell whether your firm is exposed

You do not need to be an engineer to start. These checks take minutes and can be delegated:

1. Inventory your web properties. List every site and portal associated with the firm: the main website, recruiting microsites, client portals, intake tools, and anything the marketing agency manages. Ask each owner one question: what runs this? 2. Ask your host or agency, in writing, for the PHP version on every property and the date it was last updated. A provider that cannot answer promptly is itself a finding. 3. Check support status. Compare the answer against the PHP supported versions list. Anything end-of-life is urgent. 4. Confirm the CVE-2024-4577 exposure specifically. The flaw affects PHP on Windows servers in CGI mode. If your host runs PHP on Windows, ask whether the June 2024 patches (or later) are applied. If they cannot confirm, treat it as unpatched. 5. Review plugins and themes. On WordPress, every installed plugin should have a named owner, a business reason to exist, and a current update. Delete what is unused. 6. Look for the obvious. Your own website's error pages, directory listings, and version disclosures should reveal nothing useful to an attacker. A free external assessment, such as Attorney Armor's free security scan, checks these signals non-intrusively.

The defense that actually works

Patching CVE-2024-4577 is necessary but nowhere near sufficient. A durable posture for a law firm's PHP estate has five parts:

Patch on a schedule, not on a scare. PHP core, web server software, plugins, and themes need a defined update cadence with a named owner. Emergency patching only happens after the flaw is already being exploited.

Run supported software only. Budget for upgrades the same way you budget for malpractice insurance. End-of-life software is a standing, known vulnerability, and "the agency never mentioned it" is not a defense to Rule 1.6(c).

Reduce what is exposed. Remove unused plugins, disable unneeded server modules, turn off detailed error output, and put the site behind a web application firewall where feasible. Every removed component is one less door.

Watch continuously. Exploitation of CVE-2024-4577 was observed through honeypots because defenders were watching. Firms need the equivalent for their own perimeter: monitoring that notices new exposures, unexpected changes, and lookalike infrastructure before clients do.

Verify with independent testing. Patching is a claim; penetration testing is proof. An authorized web application penetration test attempts the same attack paths a criminal would, under rules of engagement, and produces the evidence insurers, clients, and outside counsel guidelines increasingly demand.

A 30-day action plan for firm leadership

• Week 1: Complete the exposure checks above. Get PHP versions, plugin inventories, and patch dates from your host and agency in writing.
• Week 2: Patch everything. Upgrade or migrate anything on end-of-life PHP. Remove unused plugins and themes.
• Week 3: Put maintenance on a calendar with a named owner, and confirm in writing who is responsible for updates going forward.
• Week 4: Commission an independent external assessment or web application penetration test, and retain the report as evidence for insurance renewals and client security questionnaires.