PHP2Shell y tus herramientas de trabajo: qué significa una falla web crítica para tus datos

On October 21, 2026, the PHP project shipped an emergency patch for two critical flaws now known collectively as PHP2Shell — CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS score of 9.2. Within days, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities catalog after security researchers confirmed real attacks in the wild.

If you run a time-tracking tool, a project management app, or any web software, here is the uncomfortable part: this is not a bug in one product. It is a bug in PHP itself — the language that runs an estimated three-quarters of the web. The vulnerable code dates back to PHP 5.4, released in 2012. It has been sitting in the engine for over a decade.

You do not have to be a security engineer to take the right action this week. This post explains what PHP2Shell means for a business owner, an agency lead, or a contractor who just wants their tools to keep their data safe — and the short list of questions worth asking before you trust any vendor with your team's hours, rates, and client names.

What PHP2Shell actually is (in plain terms)

PHP is a programming language. A huge share of websites and web applications run on it — WordPress, many content systems, and countless custom business apps. PHP2Shell is a pair of flaws in the core PHP engine that let an attacker run their own code on an unpatched server without logging in first.

That last phrase is the whole problem. Most security incidents need a stolen password or a tricked employee. These do not. An unpatched, internet-facing PHP server can be compromised by a single crafted web request, with no credentials and no user to fool. Security researchers recorded dozens of successful break-ins against test servers within days of the flaws becoming public.

CISA's guidance was blunt: patch immediately. The flaws affect essentially every common way of running PHP for web requests.

We are not going to publish attack details here. The responsible response to a live, actively exploited vulnerability is to help people patch and protect — not to hand anyone a playbook. If you run PHP infrastructure yourself, go straight to the official PHP security advisory and CISA's alert, and update to a patched version today.

Why this matters even if you have never touched a line of code

Here is the thing most "patch now" headlines skip: you are affected by software you do not run.

Your team's time data does not live on your laptop. It lives on servers owned by the vendors you have chosen — your time tracker, your invoicing tool, your CRM, your file storage. Every one of those is a web application running on top of a stack of other people's code. When a flaw lands in a foundational layer like PHP, the blast radius is not one company. It is every company that built on top of it and has not yet patched.

So the real question for a business owner is not "is my laptop safe?" It is: "Which of the tools I trust with my data are exposed, and have they fixed it?"

That is a reasonable question to ask. Good vendors will have a clear answer.

The five questions worth asking any software vendor

You do not need to understand the vulnerability to hold a vendor to a standard. Use these as a checklist — for PHP2Shell specifically, and for the next one after it.

1. "Were you affected by PHP2Shell, and if so, have you patched?" A straight answer is a good sign. Vagueness or silence is not. A vendor that does not run PHP can simply say so.

2. "How fast do you apply critical security patches?" For a flaw already being exploited, "within hours to a day" is the standard. "We get to it in our next release cycle" is not good enough for a 9.2.

3. "Is my data encrypted, in transit and at rest?" This limits the damage if a server is ever breached.

4. "Do you keep an audit trail of who accessed or changed data?" When something goes wrong, you want a record — not a shrug.

5. "Where can I see your security posture in writing?" A privacy policy, a security page, or a status page that documents incidents all signal a vendor that takes this seriously.

If a tool holds your clients' names, your team's pay rates, and months of billable hours, these questions are not paranoid. They are due diligence.

Where tally5 stands

Since the question is fair, here is our answer: tally5 does not run on PHP. The app is built on a modern JavaScript and TypeScript stack (Node.js and Next.js), so the PHP2Shell flaws do not apply to it. There was no PHP engine to patch.

That is not a victory lap — every stack has its own vulnerabilities, and the honest position is that security is a practice, not a product. What matters is the practice behind the stack:

• Encryption in transit and at rest, so your time data, rates, and client details are protected on the wire and on disk.
• A timesheet change and approval audit trail on the Enterprise plan, so edits and approvals are traceable — the "no silent edits" standard.
• Individual logins and role-based access, so each person sees only what they should.
• A written privacy policy you can read before you decide to trust us.

We think a time tracker should earn trust the same way it tracks time: quietly, honestly, and without surveillance. No keystroke logging, no screenshots of your screen, no spyware dressed up as productivity. Just your hours, kept safe.

The one habit that protects you most

The teams that weather incidents like PHP2Shell best are not the ones with the biggest security budgets. They are the ones that keep a simple inventory: a short list of every tool that holds company or client data, who owns the relationship, and where to check each vendor's security status.

When the next critical flaw lands — and there will be a next one — that list turns a frantic scramble into a 20-minute review. You work down the list, ask the five questions, and move on.

PHP2Shell is a reminder that the software supply chain is exactly that: a chain. Your data is only as safe as the weakest link you have chosen to depend on. Choosing tools that patch fast, encrypt by default, and tell you the truth about their posture is not a technical decision. It is a business one.

Want time tracking from a team that takes this seriously? Start a 14-day free trial — full access, no credit card, nothing to uninstall if it is not for you.