Cybersecurity crisis puts client trust at risk for Canadian advisors
The PHP vulnerability and what it means for advisors
PHP, originally an abbreviation of Personal Home Page, underpins the majority of the web including WordPress, the most widely used website-building platform in the world, and an enormous share of the client portals, communication tools, and practice management software that financial advisors rely on daily.
The two vulnerabilities, which went undetected for more than a decade according to the Financial Times, were found with the assistance of OpenAI and Google AI models.
Researchers at U.S. cybersecurity firms Calif and Wiz brought the flaws to light. What makes them particularly serious is that attackers can exploit them without needing to log in meaning any site running an unpatched version of PHP could be compromised through the open internet. Online security company Cloudflare reported detecting millions of attempted exploits after the weaknesses were made public.
The Canadian Centre for Cyber Security issued an advisory on July 30, 2026 (serial number AV26-764) urging users and administrators to update to patched versions of PHP immediately and issued a new alert on October 21. Affected versions include all PHP releases prior to 8.2.33, 8.3.33, 8.4.24 and 8.5.9. For advisors whose websites, client portals, or supporting tools have not been updated, the exposure is active and significant.
Rashina Hoda, an academic at Monash University in Melbourne, Australia, warned in public commentary that while major financial institutions do not typically rely on PHP for core transactions, smaller businesses and professionals who depend on WordPress-based infrastructure are considerably more vulnerable. She also flagged the likelihood of a subsequent wave of scams and phishing attacks exploiting the confusion.
