It's good to have friends. Plain and simple, your friends look out for you. As The Technology Evangelist, I've been lucky enough to have met some amazing people in the dental technology space and one of those people is Dr. Lorne Lavine. Over the years, we've become friends. Like me, Lorne is a dentist (he actually practiced as a periodontist early in his career) and he is also a confirmed gadget guy. He made the bold move to actually get out of clinical practice and move full time into dental technology and IT services for the dental industry. Over more than 25 years, Lorne has been a stalwart for keeping dental offices safe from cyber intrusions and helping office IT systems run at their peak.
When Lorne speaks about IT and security, I listen. He's *really good at this*. That's why I'm making today's post. I got an email from Lorne's company today. He has sent this to everyone of his clients. Even if this is the first time you've heard his name, you need to read this. It's that important. There is a major security problem that has just come to his attention and you should read and implement exactly what he tells you below:
URGENT: Critical PHP Security Vulnerability — Immediate Action Required
A serious security vulnerability known as PHP2Shell has been disclosed, affecting PHP, the software technology that powers around 75% of websites and web applications, including platforms such as WordPress.
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow attackers to execute malicious code on vulnerable web servers without logging in. This could potentially result in unauthorized access, data theft, website compromise, or service disruption. Security researchers have demonstrated successful exploitation, and malicious activity has been reported.
Why this matters to your dental practice
If your website, patient portal, online appointment system, or another application runs on a vulnerable PHP installation, your systems may be at risk. The vulnerabilities affect the underlying PHP software, so updating WordPress or individual plugins alone will not resolve the problem.
What you need to do now
Please take the following steps as soon as possible:
Contact your IT provider or website hosting company. Ask them to verify whether any of your internet-facing systems run vulnerable PHP versions and to prioritize remediation immediately.
Apply the appropriate PHP security updates. The patched upstream releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The correct version depends on your environment. Older, unsupported versions require an appropriate vendor-provided fix or an upgrade to a supported release.
Verify that all affected systems are protected. This includes web servers, hosted websites, WordPress installations, and other applications that use PHP. Confirm that the fix has been applied and the relevant services restarted or redeployed as required.
If patching cannot be completed immediately, have your IT or hosting provider assess temporary protective measures, such as restricting public access or isolating the vulnerable service until it can be secured. These measures are not a substitute for patching.
Review for signs of compromise. Your IT provider should review relevant server logs, security alerts, and other available evidence for suspicious activity. If a compromise is suspected, initiate your incident response process and assess whether credentials or other secrets need to be rotated.
Official security information
PHP security announcement: https://www.php.net/
Technical vulnerability details and remediation guidance: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
Please treat this as a priority. Do not assume your systems are safe simply because your website is functioning normally or your WordPress plugins are up to date.
If you are unsure who manages your website hosting or PHP environment, contact your IT provider for assistance.
Best regards,
The Digital Dentist IT Team
Also, if you'd like to hear Lorne's appearance on The Technology Evangelist Podcast you can use this link. He was the guest for Episode 15.







