Skip to content
  • There are no suggestions because the search field is empty.

Understanding the PHP Security Updates

In this article, we’ll explain how the recent PHP security update relates to your FMG website and answer common questions.

In October 2026, two critical security vulnerabilities were announced in PHP, a programming language that runs a large share of the internet’s websites. Many broker-dealers, home offices, and news outlets have shared notices about it, and you may be wondering what it means for your FMG account and website. In this article, we’ll explain what happened, how it relates to FMG, and answer common questions from you and your security teams.

Use the links below to jump to a specific section in this article quickly:

What Happened?

PHP is a programming language that runs behind the scenes on many websites globally. On October 20, 2026, two critical vulnerabilities in PHP were made public (CVE-2026-109618 and CVE-2026-109619, also known as “PHP2Shell”). If left unpatched, these vulnerabilities could put websites running PHP at risk.

The PHP security team released a fix on October 21, 2026. Because the details became public quickly, organizations like the FBI urged anyone running PHP to apply the update right away. That’s why many home offices sent notices to their advisors and partners asking whether their vendors are affected.

Is FMG Affected?

No. The FMG platform and FMG websites are not affected by these vulnerabilities. The FMG platform is built on different technology (.NET on Windows), not PHP, so these vulnerabilities don’t apply to it. There’s no impact to your account, your website, your contacts, marketing tools, or your data, and no action is required on your part.

How FMG Protects Your Website

Even though these vulnerabilities don’t apply to FMG, we know our clients count on us to stay ahead of security threats. FMG uses a “defense in depth” approach, which means several layers of protection work together to keep your website secure. One of those layers is a web application firewall, which is designed to block attacks that target vulnerabilities like this one before they ever reach our servers.

We monitor for new security threats on an ongoing basis. In this case, our teams reviewed every platform we manage as soon as the vulnerabilities were announced, and confirmed no impact on the FMG platform.

Frequently Asked Questions

Does FMG use PHP in any systems that support my services?

No. The FMG platform and FMG websites are built on other technologies, not PHP. No FMG systems that support your services use PHP, including embedded or bundled versions.

Which FMG systems are affected, and are any internet-facing?

None. Since the FMG platform doesn’t use PHP, no FMG systems that support your services are affected.

What is FMG’s remediation status?

No remediation is needed for the FMG platform, because it isn’t affected. Your website and account continue to run as usual.

What safeguards does FMG have in place?

FMG uses multiple layers of security, including a web application firewall designed to block attacks before they reach our servers. For detailed information about our security policies, procedures, and practices, please visit the FMG Trust Center.

Has FMG reviewed its logs or confirmed its vendors are patching?

The FMG platform doesn’t use PHP, so these vulnerabilities don’t apply to it. For more information about how we monitor our systems and manage vendor security, please visit the FMG Trust Center.

Is there any impact to my integrations or the data I share with FMG?

No. There is no impact to your FMG services, integrations, or data.

Do I need to change my password or update anything?

No. No action is required on your part.

My broker-dealer or home office sent me a notice about this. What should I tell them?

You’re welcome to share this article with them. If your firm’s compliance or information security team has additional questions, our team is happy to help.

Where Can You Get More Information?

For more about FMG’s security practices, visit the FMG Trust Center. If you or your firm have follow-up questions, please contact our Client Experience team at (858)-251-2420 or service@fmgsuite.com, and we’ll make sure you get the answers you need.