Risk Notice · October 21, 2026
PHP2Shell: EveryBank Is Not Affected. Every Bank Might Be.
A critical flaw in PHP lets a stranger take over a web server with one request. EveryBank's website runs no PHP. EveryBank runs nothing at all.
EVERYWHERE (Oct. 21, 2026) — Two flaws disclosed today in PHP, the language behind a large share of the world's websites, let an attacker take control of a web server with a single request, before any of the site's own code runs. Security researchers are calling it PHP2Shell. A working exploit exists. Patches are out.
What this means for EveryBank: nothing. This website is a stack of finished pages handed out by Cloudflare. There is no PHP behind it, no server program, no login and no database. There is nothing to take over. Anyone who took it over anyway would get a dataset and a sense of humor about it.
What this means for you. EveryBank holds no accounts, so there is nothing of yours here to protect. At the banks that do hold your money: if a bank's website looks strange this week, don't log in from it. Use the bank's app, or call the number on the back of your card.
If you run a website on PHP: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to the patched version from your hosting company. Older versions only have source patches. The details →
A note on every bank
EveryBank is the average of every bank in America. Plenty of websites run on PHP, including, very likely, some of theirs, often through a local web vendor. On average, then, EveryBank is partly running PHP on a server it does not have, maintained by a vendor it has never met.
The Mean's security team patched before lunch. The Median has left a voicemail for its web guy.
"I rate EveryBank's exposure between zero and zero. Every bank's exposure is between zero and whatever the web guy says when he calls back."
— Perry Sentyle (%), Chief Risk Officer
EveryBank has not tested anyone else's website and will not. Severity and patch versions as reported by the PHP project's advisories.