The Software Under Your Software: What the PHP Security Flaw Means for Roofers
A critical flaw in PHP put servers across the web at risk. Here's what it means for roofing software, how to check yours, and what to ask your vendor.
The short answer: On October 21, 2026, PHP released emergency fixes for two critical flaws (known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619) that let attackers take over unpatched PHP servers without a password. Some roofing software runs on PHP. To check yours, look for “.php” in your software’s address bar, or ask your vendor the five questions below.
In late October, a security flaw in PHP sent IT teams around the world scrambling. If you run a roofing business, you probably didn't see the headlines, and you may never have heard of PHP. But if your business runs on software, and almost every roofing contractor does now, it's worth five minutes to understand what happened and what to ask.
What happened
On October 21, the team behind PHP shipped emergency fixes for two critical security flaws. PHP is a programming language, and it powers a large share of the websites and web applications on the internet.
The flaws were serious. Someone on the internet could take control of a server running PHP without needing a password. Details leaked online before the fix was out, and security agencies, including CISA in the U.S., are now confirming real-world attacks. Some attacks don't even take over the server. They quietly read passwords and access keys straight out of its memory.
The bugs weren't new. Researchers trace them back more than a decade, to PHP versions released around 2012. They were only disclosed in late October.
How your software works, in 60 seconds
Think of your software like a roof system. The membrane is what you see: the screens on your laptop or phone where you enter jobs, build estimates and send invoices.
Underneath is the server, a computer in a data center that stores your data and does the work every time you click. Your customer list, your pricing, your bids, your service history: it all lives there.
And under that is the deck: the programming language and the engine it runs on. You never see it, but everything above depends on it. When the deck has a flaw, every app built on it is exposed until its owner fixes it. That's why the late October news mattered so much. It wasn't a bug in one company's app. It was in the deck under millions of them.
Why this matters to roofers
At least two widely used commercial roofing platforms are built on PHP. If yours is, your data was only as safe as your vendor's response time.
Think about what's on that server. Your customer relationships. Your pricing, which a competitor would love to see. Bids, contracts, invoices, and sometimes payment details. For many contractors, it's the most valuable information in the business.
Roofers take security seriously. (Although it didn’t apply to us, a client's IT team did actually flag this flaw to us within a day!) You don't need to be technical to protect yourself. You just need to know what to ask.
The honest part
PHP isn't evil. Plenty of well-run, secure software is built on it. And no technology is bulletproof, including ours. Other popular technologies had their own security issues the same week.
The real risk is software running on old versions that no longer get security fixes, and vendors who are slow to install the fixes that do exist. That risk is growing. AI tools now help people find flaws much faster, which shrinks the gap between "a flaw is announced" and "a flaw is being used against real companies" from weeks to hours.
One other thing to note: “we updated our software” and “we’re fixed” aren’t the same thing. The fix only takes effect once the vendor updates PHP itself and restarts its servers, which is routine work but easy to put off, so it’s worth asking whether the fix is actually live.
How to tell if this affects you
Here's a quick check anyone can do. Log in to your software and look at the address bar at the top of your browser. If you see ‘.php’ in the page address (for example, …/login.php), your software runs on PHP. If you don’t, it still might, so ask your vendor. It's a fair question, and a good vendor will answer it in one sentence.
Five questions to ask your software vendor
- What version of PHP do you run, and is it still supported? Old, unsupported versions don't get security fixes. Note that PHP 8.2, a common version, stops getting security fixes on December 31, 2026. If that's what your vendor runs, ask about their upgrade plan.
- Have you updated PHP itself and restarted your servers? On what date? You're looking for a specific answer with a date, not "we take security seriously."
- Did you check for signs of a break-in, and change the passwords and keys stored on those servers? Because some attacks read secrets from memory, a careful vendor assumes they may have been exposed and replaces them.
- How quickly do you usually patch critical security issues? Hours or days is a good answer. Weeks, is not.
- Who tests your security from the outside, and can I see a summary? Independent audits and penetration tests (hiring ethical hackers to try to break in) show a vendor isn't just grading their own homework.
A good vendor answers these clearly and without getting defensive. If you get vague answers, that's an answer too. And if your vendor hasn't already reached out to you about this, that tells you something as well.
What we do at Terial
For what it's worth, Terial isn't built on PHP. But the language matters less than the habits around it. We keep our software current, patch critical issues quickly, and require multi-factor authentication internally. We'd encourage you to ask us the same five questions. We'll answer them.
The bottom line
You don't need to understand servers or programming languages to protect your business. You need a vendor who stays current, responds fast, tells you first, and can explain all of it plainly.
Key Takeaways
- On October 21, 2026, PHP released emergency fixes for two critical flaws that let attackers take over unpatched servers without a password.
- At least two widely used commercial roofing platforms are built on PHP.
- Seeing “.php” in your software’s address bar means it runs on PHP. Not seeing it doesn’t rule it out.
- “We updated our software” isn’t the same as “we’re fixed.” The fix only takes effect once PHP itself is updated and the servers are restarted.
- A good vendor can answer your security questions in a sentence or two.
FAQ
What is the PHP2Shell vulnerability?
Two critical flaws in PHP, patched October 21, 2026, that let attackers run their own code on a server without logging in. CISA added both to its list of actively exploited vulnerabilities on October 26.
How do I know if my roofing software uses PHP?
Look for “.php” in the address bar when you’re logged in. If you don’t see it, the software may still use PHP, so ask your vendor which PHP version runs its servers.
Is PHP itself insecure?
No. Plenty of secure software is built on PHP. The risk comes from old, unsupported versions and vendors who are slow to apply fixes.
Does updating my software fix the PHP flaw?
Not on its own. The vendor has to update PHP itself and restart the servers running it before the fix takes effect.
Recommended
- Roofing Contractor Technology: 2026 Guide for Commercial Teams
- How Fragmented Software Affects Roofing Margins
- Terial | Workflow Automation for Commercial Roofers
Matt Billard is the Co-Founder & CTO of Terial, software built for commercial roofing contractors.
More articles
Book a personalized demo
Get a 30-minute demo tailored to how you run your commercial roofing business
“Making the switch to Terial has greatly exceeded my expectations and has already had a meaningful impact on our team’s productivity. Terial has significantly reduced the amount of time required to complete many of our day-to-day operational tasks, allowing our team to focus more on serving our customers.”
