PHP2Shell: What Dental Clinics Need to Know

Written by

Nickolas Steel

Published

Oct 26, 2026

On October 21, 2026, two critical security flaws were disclosed in PHP, the programming language behind a large share of the web, including most WordPress websites. Together they’re being called PHP2Shell. Attacks have already started, and fixes are available now.

Here’s what it means for your clinic and what to do about it.

What is PHP2Shell?

PHP is the software that runs on a web server and builds the pages visitors see. The newly disclosed flaws allow an attacker to run their own code on a server that hasn’t been updated, without needing a password. In plain terms: an unpatched website can be taken over by someone outside your clinic.

Many dental websites run on WordPress or similar platforms that depend on PHP, so this affects a large number of clinics, often without them knowing it.

Why it matters for dental clinics

A compromised website is more than a technical problem. For a clinic, it can mean:

Lost patient trust: a hacked site can display spam, redirect visitors to scam pages, or show a “this site may be harmful” warning in Google.
Exposed patient information: contact forms, booking tools, and other connected systems can leak the details patients submit.
Lost new patients: Google can demote or flag a compromised site, cutting search visibility and calls.
Privacy obligations: a breach involving patient information can trigger reporting requirements and professional consequences.

How AI is speeding up these attacks

In the past, there was often a window of days or weeks between a flaw being announced and attackers using it widely. AI has shrunk that window.

Faster exploits: attackers use AI tools to read security advisories and write working attack code within hours of disclosure.
Automated scanning: AI-assisted tools can scan millions of websites quickly to find servers still running unpatched PHP.
Attacks at scale: small clinic websites are no longer too small to notice. Automated attacks hit every vulnerable site they find, not just big targets.
More convincing follow-up: once a site is compromised, AI makes it easier to generate realistic phishing pages and fake content that patients may trust.

The takeaway: with PHP2Shell, waiting a week to patch is no longer safe. Clinics should confirm their site is updated now.

Is DentalRx affected?

No. None of DentalRx’s services are affected:

The DentalRx App is built on Flutter, which is unaffected.
DentalRx client websites are built on Framer and NextJS, which is unaffected by PHP2Shell.
Our internal servers were patched on day 1 and are unaffected.

DentalRx clients and app users do not need to take any action.

Why DentalRx sites are better protected

DentalRx builds client websites on Framer and NextJS, and that choice is a big reason our clients aren’t exposed to PHP2Shell.

No PHP to attack: Framer sites don’t run PHP, so this vulnerability doesn’t apply.
No server to maintain: Framer manages the hosting and infrastructure, including security updates. Your clinic doesn’t depend on someone remembering to patch a server.
No risky plugins: Many WordPress breaches come from outdated third-party plugins. Framer sites don’t rely on server-side plugins that can fall out of date.
Secure delivery by default: Framer serves sites over HTTPS through a global content delivery network, which also helps with speed and uptime.

No website is immune to every threat, but removing the server software, plugins, and manual updates that attackers target most closes off the most common ways clinic sites get compromised.