Shieldpay warns law firms face heightened cyber risk from PHP flaw

Shieldpay, an FCA-regulated payments platform serving more than 50 of the UK's top 200 law firms, has issued a warning that the legal sector faces elevated cyberattack risk following the disclosure of a critical vulnerability in PHP, the server-side scripting language estimated to power the majority of law firm websites. The company says firms using WordPress-based infrastructure are particularly exposed, and warned that attacks could materialise within days.

Sophie Condie, chief executive of Shieldpay, said the combination of high-value transactions and prominent brand visibility makes legal practices an attractive target. "Cyber criminals know that firms handle large volumes of money and sensitive client information, which makes them an attractive target," she said. "This PHP vulnerability is likely to lead to a rise in attempted attacks on law firms in the coming days and weeks, and staff need to stay vigilant."

The threat landscape

Shieldpay's warning is grounded in a broader pattern of legal sector vulnerability. Research cited by the company from the National Cyber Security Centre found that 75% of UK law firms had experienced a cyberattack, a figure that underscores the degree to which the profession has already become a primary target for threat actors.

The specific risks associated with a PHP compromise in a law firm context are material. Condie noted that attackers who gain access to a firm's web infrastructure could exploit unsecured contact forms to harvest client data, or use domain access to send spoofed emails containing fraudulent payment instructions. The latter scenario is consistent with a well-documented class of attack known as business email compromise, which has caused substantial financial losses across professional services globally.

Shieldpay advises affected firms to engage their in-house information security and IT teams immediately, and to seek advice from regulated payment providers where dedicated resource is not available.

Competitive and regulatory context

The advisory is commercially motivated: Shieldpay's core offering covers know-your-customer checks, safeguarded fund holding and auditable payment disbursement, and its client base sits squarely within the demographic most exposed by the vulnerability. That context does not diminish the underlying concern, but readers should note the source has a commercial interest in raising awareness.

The PHP flaw arrives at a moment of heightened regulatory scrutiny for the legal sector's cybersecurity posture. The Solicitors Regulation Authority has repeatedly flagged cybercrime as one of the most significant risks facing UK firms, and its 2025 risk outlook pointed to social engineering and payment fraud as primary threat vectors. Under UK GDPR, a successful breach of client data must be reported to the Information Commissioner's Office within 72 hours, creating an acute compliance obligation for firms that delay remediation.

For smaller practices without a dedicated security function, the practical guidance is to prioritise PHP patching, review web application firewall configurations, and audit email authentication records (SPF, DKIM, DMARC) to reduce domain-spoofing exposure. The wider lesson is structural: law firms that have deferred investment in modern IT infrastructure now face concentrated risk from vulnerabilities affecting widely deployed open-source stacks. That dynamic is unlikely to ease as threat actors increasingly automate scanning for known CVEs within hours of public disclosure.