PHP2Shell flaws put RIA website vendors under 72-hour breach-reporting duty

Two critical flaws in PHP, the back-end language that an estimated 70% of the world's websites run, sent security and compliance teams scrambling today, according to Financial Advisor Magazine. The bugs, dubbed PHP2Shell, let an attacker seize control of a server without logging in by injecting malware remotely. They had gone unnoticed for at least a decade before surfacing in August, the report said.

Under Reg S-P, a vendor has 72 hours to tell an SEC-registered advisor about a breach, and the firm then has 30 days to notify affected clients, according to the report.

Broadridge, which has built more than 19,000 websites for financial advisors, said it does not use PHP in its products, according to the report. Snappy Kraken/Advisor Websites and FMG Suites are also named as major providers of advisor sites; the report does not specify what either runs on.

Mark Hurley, a former Merrill Lynch managing director who now runs Digital Privacy & Protection, told the magazine that advisors probably have no direct role in the technical response. "For advisors, it's not that big of a deal because custodians—and not advisors—hold client assets," he said, adding that the greater risk to clients' assets would be a breach at Schwab or Fidelity, where those assets are held.

Finra Rule 3310 requires a member firm to file a suspicious activity report if a breach involves cyber-enabled fraud, identity theft or unauthorized fund transfers of $5,000 or more. Hurley and the PHP Foundation, which maintains the language, urged firms to ask their hosting provider whether the site runs PHP or a platform built on it such as WordPress, confirm the emergency patches are installed, and take the server offline if they cannot be. Firms should log the response and keep the emails as proof the work was done.