In short: For law firm IT security, every system counts through which clients send or retrieve documents. Determine which of them run on PHP, have the patch level and restart confirmed, and treat every suspected case in a way that preserves evidence and confidentiality.
Where law firms use PHP, often without knowing it
The law firm software itself usually sits in the office or in a specialised data centre. PHP is found elsewhere: on the firm's website with its form for first enquiries, in upload routes for documents, in online appointment booking and in self-hosted data rooms. Many law firms use their own Nextcloud, set up by an IT systems house, for secure document exchange.
It is precisely these data rooms that hold the most sensitive material a law firm has: briefs, powers of attorney, draft contracts, expert opinions, photographic evidence and, in criminal cases, investigation files. PHP2Shell allows attackers to execute code without logging in. A strong password on the portal does not help against that.
Firms specialising in areas such as family, employment or medical law additionally process health information, expert reports and details from private life. In commercial law firms, documents on transactions are stored that may be price-sensitive before they are published. What material sits in your portals determines how serious an incident is.
Professional secrecy and data protection: what a leak means
Lawyers are bound by a professional duty of confidentiality. The unauthorised disclosure of client secrets can be a criminal offence under Section 203 StGB (German Criminal Code). In addition there are the obligations under the GDPR, which include special categories of data where health or criminal proceedings are involved.
A data leak therefore hits law firms twice. It endangers ongoing mandates, for instance when negotiating positions or draft settlements fall into the wrong hands. And it damages the trust on which the client relationship rests. Whether and how you must inform clients and the supervisory authorities is something you assess with your data protection officer and professional-law advice.
The law firm website as a tool for fraud
A compromised law firm server serves attackers not only as a data source. With letterhead, file numbers and real names from a client portal, letters can be forged that are barely distinguishable from genuine ones. Particularly sensitive are payment requests, for example for settlement amounts or fees, with a changed bank account.
The form for first enquiries can also be abused: an attacker redirects enquiries to their own address and contacts prospective clients in the firm's name. After an incident you should therefore not only have the server checked but also actively point out to clients that you never change bank details by email.
The special electronic lawyers' mailbox and the law firm software do not run on your web server. It becomes dangerous where credentials for mail accounts or other firm systems are stored on the web server.
Law firm IT security: who is responsible for what?
In law firms without their own IT department, tasks are usually distributed like this:
| System | Who looks after it | Open question for PHP2Shell |
|---|---|---|
| Law firm software, workstations | IT systems house | usually not affected |
| Nextcloud or data room | IT systems house or host | Who patches PHP and restarts? |
| Website with forms | Web agency | Is it running on current PHP at the host? |
| Online appointment booking | External provider or plugin | Where are the clients' concerns stored? |
The gap arises where the systems house regards the website as the agency's business and the agency regards the server as the host's. Record in writing, for each system, who updates PHP and restarts the processes.
Do not clean up a suspect server prematurely. If you rebuild it before evidence is preserved, you will later be unable to prove whether and which client data was leaked.
The first hours: act confidentially and traceably
- Block the affected portals and data rooms for clients and continue internal work through the law firm software.
- Preserve logs from 20 October 2026 onward and keep the state of the server intact before anyone deletes files.
- Ask the operator in writing for the patch level and the restart. A displayed version number alone is not enough, because backports can leave it unchanged.
- Define a small circle that talks about the incident, and prepare external communication.
- Involve the data protection officer and keep the GDPR reporting deadline in view.
How does PHP SOS help?
- Before the first access, we settle confidentiality in writing and limit access to what is necessary.
- We check the patch level, operating mode and restart of all the firm's PHP systems that are reachable from the internet.
- If you suspect a problem, we preserve evidence forensically so that it can later be shown what was accessed. Details on our page about IT forensics.
- We clean up and harden the systems and document every step for the firm's management, the data protection officer and the insurer.
- On request we take over the ongoing maintenance of the portals, so that the next PHP vulnerability does not again fall between the systems house and the agency.
Frequently asked questions
Is our law firm software affected by PHP2Shell?
The actual law firm software usually does not run on a PHP web server. What can be affected are the website, upload forms, self-hosted data rooms such as Nextcloud, and portals built on PHP. An inventory of all systems reachable over the internet brings clarity.
May an external IT service provider access client data during an incident?
Professional law and Section 203 of the German Criminal Code (StGB) allow the involvement of assisting service providers under certain conditions, in particular an obligation of confidentiality. Which requirements apply to your firm in detail is a matter for professional-law review. We settle confidentiality in writing before the first access.
Do we have to inform clients about an attack?
Where there is a risk to the rights of the people affected, the GDPR may require a notification, and professional-law considerations come on top. The decision belongs in the hands of the firm's management and the data protection officer. Coordinated communication prevents contradictory statements.