Last week, two critical flaws in PHP sent companies across the web into emergency patching, and some well-known SaaS tools went offline to do it. Here's what happened, why ContractSafe customers never noticed, and what to ask your own contract software vendor.
Key Takeaways
- PHP2Shell is a pair of critical flaws in PHP, the language behind a large portion of the web. It let attackers take over servers without logging in.
- Companies across the web spent October 21 patching, and many took their apps offline to do it. Dropbox Sign shut its site for almost two hours.
- ContractSafe doesn't use PHP. We didn't have to patch, our customers didn't lose access, and none of our data was ever compromised.
- If your contracts live in a SaaS tool, now's the time to ask that vendor what it runs on and how it handled PHP2Shell.
The week most of the web had to patch
On October 20, details of two critical bugs in PHP leaked online, a day before PHP planned to release fixes. PHP runs about 69% of websites whose server-side language is known. That means a huge share of the internet, and a lot of the SaaS apps companies use every day, suddenly had a door an attacker could walk through without a password.
The flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell) sit inside PHP itself. It didn't matter how carefully a company wrote its own software. If it ran PHP, it was exposed until it patched. Although PHP disclosed some temporary mitigations, they said that no complete mitigation was available outside of patching.
The story went mainstream within hours:
CISA issued an alert titled "Critical Vulnerabilities in PHP Require Immediate Patching" and told organizations that couldn't update to take their PHP systems offline.
Wiz, one of the research teams that reported the bugs, compared PHP2Shell to Heartbleed, the 2014 bug that's still the yardstick for internet-wide security emergencies.
The New York Times called PHP "pervasive" and warned that everyday users' data could be at risk.
Palo Alto Networks' Unit 42 counted more than 22.6 million exposed instances potentially vulnerable.
Reuters, BBC News, NBC News, Ars Technica and BleepingComputer covered the scramble.
Governments in the Netherlands, Finland and France pulled sites offline as a precaution. So did the Wikimedia Foundation and the Internet Archive. By October 26, BleepingComputer reported confirmed attacks in the wild.
What it looked like for e-signature and contract tools
For companies that run on PHP, October 21 meant emergency maintenance. Dropbox Sign was one of them. At 7:19 AM Pacific, its status page posted, "Due to vulnerabilities in PHP, we have temporarily taken our website offline as a precaution." The site came back at 9:13 AM after the company upgraded PHP.
Dropbox Sign hasn't reported any data exposure, and taking the site down to patch was the responsible call. But for nearly two hours on a Wednesday morning, its customers couldn't send documents for signature. Downstream, software companies that depend on Dropbox Sign had to post their own outage notices.
That's the hidden cost of a vulnerability like this. Even when nothing's stolen, deals stall, signatures wait and teams scramble to explain the delay.
Why ContractSafe wasn't affected
ContractSafe doesn't use PHP. Our security team confirmed that the ContractSafe application isn't built on it, so PHP2Shell had no way in.
Here's what that means for our customers:
No emergency maintenance. There was nothing in our application to patch.
No PHP2Shell downtime, except for our e-sign feature powered by Dropbox Sign. We never took ContractSafe offline for it, and customers kept working with their contracts as usual.
No exposure. The contracts in customers' contract repository were only reachable if they were sent for e-signature through Dropbox Sign. None of these were reported as being exposed.
No platform is immune to every future vulnerability, and we watch the advisories for every tool we use. But when a flaw hits a language most of the web depends on, the stack your contract tool runs on matters.
Questions to ask your contract software vendor
Your contracts hold pricing, renewal dates, personal data and the terms your business runs on. Any vendor storing them should be able to answer these quickly:
Do you run PHP anywhere in the product, including inside third-party components?
If so, when did you patch PHP2Shell, and did you take the product offline to do it?
Did you find any sign of compromise, and how did you check?
How do you tell customers when a vulnerability like this affects them?
If you don't get clear answers, that tells you something too.
Keep your contracts somewhere that stays up
ContractSafe gives legal, finance and operations teams one secure place to store, search and track every contract, with unlimited users on every plan. Schedule a demo to see how it works.
.svg){kind=logo}
.svg)
