What the PHP Vulnerabilities Reveal About How Credit Unions Must Manage Vendor Risk

Sarah Snell Cooke, Founder/CEO, The Credit Union Connection and Cooke Consulting Solutions

Federal officials have announced ne’re-do-wells are actively exploiting two critical flaws in PHP, software reportedly used by roughly 70% of web-facing servers – possibly your credit union’s site and other sites critical to your operations. 

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed the exploitation on Monday and gave civilian federal agencies three days to fix their systems, TechCrunch reports. The bugs let attackers break into a vulnerable system online without a password. The NCUA has not returned my emails since Wednesday; might mean nothing, but I feel the agency has been really quiet on this regarding the agency and advising credit unions.

CISA’s alert didn’t say who is behind the attacks, and no US bank or credit union had publicly reported a successful breach as of American Banker’s Oct. 23 reporting, though that’s a snapshot of a story moving by the hour.

Up to 35 successful exploits have been pulled off as of Oct. 29 per The Register.

Responding to PHP2shell

Consider what MSU Federal Credit Union did last week: it took its website and digital banking offline for 24 hours while it scoured its systems as a precaution. The $8.9 billion credit union wasn’t breached or compromised. Its branches, call center, ATMs and cards kept remained up during the 24 hours. 

The systems MSU FCU took down were built and maintained in-house. Most credit unions aren’t in that boat. Hosting companies or web developers typically run their websites. As always, it doesn’t matter if you use a third-party who didn’t patch fast enough; the credit union still owns the risk. 

“We’re on the latest WordPress” is not an answer, because the flaw lives in PHP itself. PHP 8.1 and older no longer get updates from the PHP project, though some vendors offer backported fixes, meaning they adapt the new patch to work on older versions. 

The FBI advised organizations to inventory where PHP runs, starting with internet-facing systems and any products that bundle it. Ask your IT team: 

• Could we produce that inventory today, not next week? 
• Which versions are we running and who patches them? 
• If something can’t be patched, can we take it offline and what breaks when we do? 

If the answer is “let me get back to you,” you’ve found your gap.

Then ask your vendors, in writing: 

• Does any product or subcontractor you rely on run PHP? 
• Which version? 
• When was it patched, and how do you know? 
• Any signs of compromise? 
• And who are your vendors’ vendors? 

Ask for evidence.

8 things that belong in your vendor contracts

If your agreements are silent on all of this, you’re negotiating in the middle of the crisis (the worst possible time). Look for:

1. Fast incident notification. NCUA’s 72-hour clock for credit unions doesn’t wait on your vendor’s communications team, so require notice in 24 hours or less.
2. Patch timelines for critical vulnerabilities measured in days, or hours for internet-facing systems, not quarters.
3. Who owns the fix. Spell out whether your credit union or the vendor is responsible for patching, testing and repairing what breaks and who pays when there’s downtime.
4. A software inventory and prompt notice of end-of-life components.
5. Subcontractor disclosure with security obligations that flow down.
6. Evidence on request, like pen tests, SOC reports, remediation attestations and audit rights.
7. Cost responsibility for forensics, member notification and credit monitoring, backed by cyber insurance.
8. Recovery commitments and an exit plan that gets your data back.

Who you should have on your team

A contract tells vendors what they owe you. Your own team decides whether anyone notices when they don’t deliver. These are the positions a credit union should have covered, even if one person wears more than one hat:

A CIO or CISO. The person accountable for technology and security risk, with the authority to pull a system offline in the middle of the night. At smaller credit unions, that can be a named executive, a shared CISO or a virtual one.

A vendor management lead. Someone whose job is knowing every vendor that touches member data or your website, tiering them by how badly an outage would hurt and keeping security contacts current. For many credit unions, the vendors are the attack surface, so this can’t be a side project.

A hands-on IT or security administrator. The person who maintains the software inventory and knows what’s patched.

A compliance officer. The person who knows what to tell the examiner and when the 72-hour clock starts.

An operations or business continuity lead. The person who keeps branches, call centers and cards running while digital channels are down.

Then put them in the same room. PHP2Shell and other cyber vulnerabilities are not just an IT problem. Silos can heighten the mess because you’re already behind. Run tabletop exercises where your priority systems are down for 48 hours, and make sure the full board hears the results, not just the audit committee.

Rethinking outsourcing?

Don’t. Most credit unions can’t staff a 24/7 security operation and shouldn’t try. 

But maybe rethink how. 

Fewer, better-vetted vendors beat a sprawling list, but also keep an eye out for concentration risk. UpGuard’s review of 2026 financial-sector breaches describes how Marquis, a marketing and analytics vendor relied on by more than 700 banks and credit unions, was compromised through an edge security appliance, affecting roughly 1.35 million customers and members across 74 or more credit unions and banks. One vendor, dozens of institutions and the vendor is virtually invisible to the people affected. That’s your credit union’s reputational, legal, financial and other assorted risks concern. 

For homework: Pick one vendor that touches your members’ money or data and ask how they learned about PHP2Shell, how long it took them to patch and what they would have told you if you hadn’t asked. A quick answer is a good sign. 

A long pause tells you something, too. These flaws sat unpatched for two years until researchers used an AI model to find a way to exploit them, and attackers have the same tools. It’s not a question of if, but when.

And if you need PR or crisis communications assistance and training, please reach out to me at sarah@cookeconsultingsolutions.com.