A major software vulnerability is exposing a much bigger problem: Many tax and accounting firms have no idea how secure their technology actually is.
By Lee Reams | CEO, CountingWorks
‍
Do you know who’s responsible for keeping your firm’s website secure?
I’m guessing a surprising number of tax and accounting firm owners couldn’t answer that question with confidence.
Last week, the technology industry was forced to confront two critical security vulnerabilities in PHP, the programming language behind millions of websites and web applications.
Developers, hosting providers, and technology companies moved quickly to assess affected systems and deploy security updates. Meanwhile, many small businesses probably had no idea anything had happened.
And that’s the real problem.
Your website might look beautiful. Your client portal might work perfectly. Your software might do everything you need it to do. But who’s making sure the technology underneath it is secure?
That’s a question worth asking when your business is entrusted with some of the most sensitive personal and financial information your clients possess.
I spend a lot of time talking about how technology, automation, and artificial intelligence are transforming the tax and accounting profession. I’m incredibly optimistic about where we’re heading.
But the events of last week are a reminder that building a modern firm isn’t just about adopting better technology. It’s also about understanding the responsibility that comes with it.
And I think this is a particularly good time for every firm owner to take a closer look at their security practices.
Not just their website.
Their client communications, employee access, software providers, Written Information Security Plan (WISP), and increasingly, how they’re using AI.
Because there’s a good chance something important is being overlooked.
What Actually Happened With the October 2026 PHP Security Vulnerabilities?
Let’s start with a little background.
PHP is a widely used programming language that powers websites and web applications, including much of the technology behind WordPress.
Most tax professionals have probably never heard of it.
And frankly, they shouldn’t have to understand how to program in PHP to operate a secure website.
But they should know who’s responsible for maintaining it.
On October 21, 2026, the PHP development team released emergency updates addressing two critical security vulnerabilities:
CVE-2026-109618: A memory-handling vulnerability that could potentially allow attackers to execute unauthorized code on affected servers.
CVE-2026-109619: A vulnerability involving improperly retained internal application state that could also create opportunities for unauthorized code execution.
Both were assigned critical severity ratings of 9.2 out of 10 under CVSS v4.0.
In certain configurations, an attacker could potentially exploit these vulnerabilities without first authenticating to the affected application.
The PHP development team released corrected versions, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Organizations running affected versions were urged to update immediately.
Then, on October 23, the PHP security team issued another advisory involving a separate vulnerability, CVE-2026-115560.
This additional issue involved an unusual combination of session-handling configurations. The team recommended a specific temporary mitigation while preparing a fix through its regular release cycle.
That detail matters.
It demonstrates that cybersecurity isn’t always a matter of identifying a problem, installing one update, and declaring victory.
New information emerges. Additional vulnerabilities are discovered. Security teams must continually monitor, evaluate, and respond.
For anyone interested in the technical details, the PHP project has published its official October 2026 security advisories.
Now, let’s put this in perspective.
These vulnerabilities did not mean every PHP-powered website was compromised. Actual exposure depends on the software version, server configuration, and other environmental factors.
But the potential consequences were serious.
And for organizations still running outdated or unsupported technology, responding can be considerably more complicated.
That’s where this becomes relevant to tax and accounting professionals.
Your Website May Be Your Firm’s Most Overlooked Security Risk
Let me ask you a few questions.
Who built your firm’s website?
Was it a freelance developer five years ago? A marketing agency? Someone in your office who knew a little WordPress?
Where is it hosted?
What software is running underneath it?
And when was that software last updated?
I suspect plenty of firm owners know exactly how much they pay for their website but couldn’t tell you who’s responsible for maintaining its security.
That’s understandable. You’re running a tax or accounting practice, not a technology company.
But there’s an important distinction between outsourcing website development and making sure someone is accountable for ongoing security.
A website that works isn’t necessarily a website that’s secure.
The WordPress Problem Most Firm Owners Don’t Understand
Let me be clear: WordPress isn’t inherently insecure.
It’s an enormously popular platform that can be operated securely when it’s properly configured and maintained.
The challenge is that a typical WordPress website depends on multiple technologies.
You have WordPress itself, plugins, themes, hosting infrastructure, databases, and the underlying PHP environment.
All of these components require attention.
Here’s something many business owners don’t realize.
Updating WordPress isn’t the same thing as updating the software running underneath it.
You can have the latest WordPress version, updated plugins, and a perfectly functioning website while your server continues running vulnerable PHP software.
And clicking “Update Plugins” inside WordPress won’t fix a vulnerability in the underlying PHP runtime.
PHP updates generally require action through your hosting provider, server administration tools, or managed hosting environment.
If you’re using a managed WordPress provider, someone may already be handling those updates. That’s great.
But have you verified it?
If you’re using a DIY website, inexpensive shared hosting, or a developer who built your site several years ago, you may need to ask some uncomfortable questions.
For example:
- Who monitors security vulnerabilities affecting our website?
- Are we running supported versions of PHP and other underlying software?
- Who updates our plugins, themes, and server environment?
- How quickly are critical security updates installed?
- Are backups performed and periodically tested?
- Do we have a process for responding to a newly discovered vulnerability?
- Who is accountable when something needs immediate attention?
You don’t need to know how to configure a server.
You do need to know that somebody responsible is doing it.
And this gap between website maintenance and everyday business operations leads directly to another issue: your firm’s legal responsibility to protect client information.
Your Written Information Security Plan Isn’t Just Another Compliance Document
Here’s something that shouldn’t surprise anyone in our profession.
The IRS has been telling tax professionals for years that they need a Written Information Security Plan, commonly called a WISP.
In fact, on August 18, 2026, the IRS and its Security Summit partners issued another reminder emphasizing the legal requirement for tax professionals to maintain a written information security plan.
You can read the IRS announcement and WISP guidance.
But here’s my concern.
How many firms actually keep these plans current?
It’s one thing to create a WISP, complete a template, save the document, and check a box.
It’s another thing entirely to maintain a security program that reflects how your business operates today.
Think about everything that may have changed in your practice over the last three years.
You’ve probably added software. Perhaps you’ve hired remote employees, introduced new client communication tools, adopted cloud applications, or connected systems through third-party integrations.
And if you’re like many firms, you’ve started experimenting with artificial intelligence.
Now ask yourself:
Does your WISP actually address any of those changes?
If it doesn’t, you have work to do.
A modern WISP should reflect how your firm collects, stores, processes, shares, and protects client information.
It should identify who’s responsible for information security, how risks are evaluated, how employees access confidential data, and what happens when something goes wrong.
The IRS provides Publication 5708 as a practical resource to help tax professionals develop or update their plans.
But the important point isn’t which template you use.
It’s whether your security policies reflect reality.
A WISP that hasn’t kept up with your technology isn’t much of a security plan. It’s a historical document.
The FTC Safeguards Rule: Outsourcing Technology Doesn’t Eliminate Responsibility
The IRS isn’t the only agency tax and accounting professionals need to pay attention to.
The Federal Trade Commission’s Safeguards Rule establishes information security requirements for covered financial institutions, including tax preparation businesses.
Under the rule, covered organizations must develop, implement, and maintain an appropriate written information security program.
Depending on the firm’s circumstances and applicable provisions, responsibilities include risk assessments, access controls, encryption, multi-factor authentication, employee training, security testing, vendor oversight, and incident response planning.
The rule also establishes reporting requirements for certain security events involving the unauthorized acquisition of at least 500 consumers’ unencrypted information.
You can review the FTC’s official Safeguards Rule guidance.
One provision is particularly relevant to our discussion.
Vendor oversight.
Your firm may outsource website hosting, practice management, document storage, and other technology functions.
That’s perfectly reasonable.
But outsourcing those functions doesn’t mean you can simply assume that every vendor is properly managing security.
You still need to understand which responsibilities belong to your technology providers and which remain with your firm.
And that includes asking questions before something goes wrong.
What security controls does the vendor maintain? How does it respond to vulnerabilities? What happens to your data? What protections exist if a service is compromised?
Security shouldn’t be an afterthought in your technology purchasing decisions.
It should be part of how you evaluate the technology in the first place.
Let’s Talk About Email. Because We’re Still Getting This Wrong.
After all the money our profession has spent on technology over the last two decades, I’m amazed at how casually sensitive information is still exchanged.
A client emails a tax return.
An employee sends a spreadsheet containing Social Security numbers.
Someone forwards a confidential attachment to a personal email account because it’s more convenient.
A client asks for a copy of a return, and someone attaches the PDF without considering whether ordinary email is the appropriate delivery method.
We all know better.
But convenience has a way of overriding good security practices.
And this isn’t simply about whether your email provider encrypts messages during transmission.
Messages can be forwarded, downloaded, stored on personal devices, or exposed when an email account is compromised.
An email sent to the wrong recipient can create a confidentiality problem even when the email system itself is functioning securely.
For tax returns, financial statements, identification documents, and other highly sensitive information, firms should establish clear policies requiring appropriately secured communication and document-sharing methods.
That includes using secure client portals where appropriate, enabling multi-factor authentication, limiting access, and verifying changes to payment instructions through trusted channels.
It also means regularly training employees.
Because the most sophisticated security technology in the world won’t prevent every mistake made by someone who’s rushing to finish their day.
Security is as much about employee habits as it is about software.
And now, artificial intelligence is introducing an entirely new set of considerations.
AI Is Creating a New Frontier in Client Privacy
I believe artificial intelligence represents one of the greatest opportunities our profession has ever experienced.
It can help tax and accounting professionals work more efficiently, identify advisory opportunities, improve client communications, and deliver services that previously required significant manual effort.
But I also think many firms are moving into AI without fully understanding the privacy implications.
Consider how easily this happens.
A tax professional uploads a client’s return into a general-purpose AI application and asks it to identify planning opportunities.
A bookkeeper copies financial statements into a chatbot to generate a management summary.
An employee shares a confidential client email with an AI assistant and asks it to draft a response.
Someone connects an AI agent to Google Drive, email, or an accounting platform without fully understanding what information the agent can access.
The productivity benefits are real.
But so are the risks.
The IRS Has Already Weighed In on AI
In June 2026, the IRS Office of Professional Responsibility published Introductory Guidelines for Responsible AI Use in Federal Tax Practice.
The guidance addresses professional responsibility, the need to verify AI-generated work, and the importance of protecting confidential taxpayer information.
It also highlights the potential consequences of unauthorized disclosure or use of tax return information under Internal Revenue Code Sections 7216 and 6713.
And this is where things become particularly important.
Under Section 7216, tax return information is defined broadly. It isn’t limited to Social Security numbers or other obvious identifying information.
It can include financial information, return details, and other information obtained in connection with preparing a tax return.
Whether information can be shared with a particular technology provider depends on the circumstances, applicable regulatory exceptions, and any required taxpayer consent.
You can review the IRS Section 7216 Information Center for additional guidance.
The bottom line?
Just because an AI application allows you to upload something doesn’t mean you’re automatically authorized to share it.
And the responsibility doesn’t disappear simply because the tool promises not to train its models on your data.
Five Questions Every Firm Should Ask Before Using AI With Client Information
Before employees begin using an AI application with confidential client information, I’d want answers to five questions.
1. What information does the AI actually receive?
Does it need access to the client’s identity, or could it complete the task using less sensitive information?
2. Does the provider use our information to train its models?
Understand the specific data-use terms associated with the product and account you’re using.
3. Where does the information go?
Determine whether information is transmitted to additional processors, integrations, or external AI model providers.
4. Who can access it, and how long is it retained?
Review permissions, retention policies, deletion procedures, and administrative controls.
5. Does this particular use comply with our legal and professional obligations?
Review Section 7216, applicable consent requirements, engagement terms, and your firm’s information security policies.
AI should absolutely be part of the future of tax and accounting.
But responsible adoption requires more than subscribing to another software application.
It requires understanding how that application handles information your clients have trusted you to protect.
Tokenization: Helping AI Understand the Work Without Unnecessarily Exposing the Client
One of the approaches I find particularly promising is tokenization.
The concept is relatively simple.
Instead of sending every piece of identifying information to an external AI model, a system can replace certain sensitive values with substitute identifiers, or tokens.
Imagine an AI application analyzing a client’s financial information.
Instead of sending a client’s actual name, taxpayer identification number, bank account details, and other identifiers, a privacy layer can replace supported identifying fields with tokens.
For example:
Original information:
Client: Jane Smith
Taxpayer ID: [Sensitive identifier]
Annual income: $185,000
Information processed with tokenization:
Client: CLIENT_001
Taxpayer ID: TAX_ID_001
Annual income: $185,000
The AI may still be able to analyze relevant financial information without needing to know the client’s actual identity.
In a properly designed architecture, the relationship between the tokens and the original identifying information is maintained within a protected environment.
When the AI returns its analysis, authorized software can associate the results with the appropriate client.
That’s powerful.
But let’s be careful about what tokenization does and doesn’t accomplish.
Tokenization reduces unnecessary exposure of sensitive information. It does not automatically make the remaining information anonymous or satisfy every legal requirement.
Tax professionals still need to evaluate their obligations under Section 7216, including whether a particular use or disclosure requires taxpayer consent under the applicable regulations.
Even financial information that no longer includes a client’s name may remain protected tax return information.
Tokenization should be viewed as one layer of a broader security and compliance strategy.
How We’re Thinking About AI Privacy at CountingWorks
At CountingWorks PRO, we’ve been investing in additional privacy protections within MAX, our AI intelligence platform designed for tax and accounting professionals.
Our philosophy is straightforward:
AI should understand the work without unnecessarily knowing who the client is.
For supported workflows, we’ve designed a privacy layer that identifies and masks certain categories of personally identifiable information before information is transmitted to external AI models.
That includes supported identifiers such as names, taxpayer identification numbers, contact information, and financial account details.
We also maintain contractual restrictions designed to prevent external AI model providers acting on our behalf from using customer information to train their public foundation models.
Of course, privacy protections also require permissions, access controls, appropriate data-handling practices, and human oversight.
No single technical safeguard eliminates every risk.
But we believe these protections should be built into the architecture of professional AI rather than added later.
Firms exploring these issues can learn more about CountingWorks PRO’s security approach and the platform’s AI data-use policies.
The broader point is that responsible AI isn’t simply about what the technology can do. It’s about what the technology is permitted to do, what information it needs, and how that information is protected.
That’s an important distinction as our profession moves toward increasingly intelligent software.
Your Technology Vendors May Be Secure. But Is Your Entire Technology Stack?
Most tax and accounting firms don’t operate on one technology platform.
They operate on a collection of applications that have accumulated over time.
A website provider.
Tax preparation software.
Practice management.
A client portal.
Email.
Cloud document storage.
Payment processing.
Scheduling.
Marketing automation.
And now a growing assortment of AI applications, agents, and integrations.
Individually, many of these applications may have excellent security practices.
But what happens between them?
Which applications share information?
What permissions have been granted?
Who can export client data?
What happens when an employee leaves?
What information is being retained in systems nobody remembers using?
And who is responsible for understanding how all of this fits together?
I’ve written previously about the hidden risks of building a DIY AI technology stack.
The issue isn’t that integrating different applications is inherently bad.
It’s that each additional integration can introduce new data flows, permissions, maintenance requirements, and dependencies.
That’s why technology strategy and security strategy increasingly need to be part of the same conversation.
At CountingWorks, our focus on practice management built around the client reflects this philosophy.
We believe the future isn’t simply about giving firms more software.
It’s about creating connected experiences where client information, communications, workflows, and AI operate within an intentional structure.
Because adding technology without understanding how it all works together isn’t necessarily modernization.
Sometimes it’s just adding complexity.
Don’t Forget Your Cybersecurity Insurance
Here’s another area that deserves attention.
Many firms have purchased cyber liability insurance. That’s a good start.
But have you reviewed what the policy actually covers?
More importantly, do your firm’s current practices match the information provided when the policy was purchased or renewed?
Cyber insurance applications frequently ask about multi-factor authentication, backups, employee training, access controls, and other security measures.
Those answers matter.
Imagine completing an insurance application stating that your firm requires MFA across sensitive systems, only to discover later that several employees never enabled it.
Or believing that your software provider maintains adequate backups without ever verifying what those backups actually include.
I’m not suggesting that every mistake automatically results in denied coverage. Policy terms, underwriting representations, applicable law, and the circumstances of a claim all matter.
But this is another reason to periodically review your security practices.
Sit down with your insurance adviser.
Understand your coverage, exclusions, notification requirements, and obligations.
Make sure your firm’s security representations are accurate.
Because cybersecurity insurance should be part of your risk management strategy, not a substitute for having one.
The 2026 Tax & Accounting Firm Security Self-Assessment
If last week’s PHP vulnerabilities accomplish anything positive, I hope they encourage more firm owners to ask a few basic questions about their technology and security practices.
You don’t need to become a cybersecurity expert.
But you should know who’s accountable for protecting your firm’s systems and client information.
Here are 12 areas I’d review.
Part 1: Technology & Infrastructure
Part 2: Client Information & Compliance
Part 3: AI & Risk Management
This isn’t an exhaustive cybersecurity program, and firms should adapt their controls to their particular risks and legal obligations.
But it’s a useful starting point.
If you can’t confidently answer several of these questions, those are good areas to prioritize.
I’d encourage firm owners to share this assessment with whoever manages their technology and information security.
And rather than treating the review as a one-time project, make it part of your ongoing practice operations.
Because technology changes too quickly for security to be something you think about once a year.
The Firm of the Future Must Also Be a Trusted Firm
I spend a great deal of time thinking about what the tax and accounting firm of the future will look like.
AI will automate more work.
Intelligent systems will identify opportunities we previously missed.
Software will become more proactive.
Marketing will become more personalized.
Client relationships will become more valuable.
And independent tax and accounting professionals will have access to capabilities that were once reserved for much larger organizations.
I think that’s incredibly exciting.
But as we move into this next generation of technology, there’s something fundamental we can’t afford to forget.
The most valuable asset your firm has isn’t its technology. It’s the trust your clients place in you.
Think about what your clients share with you.
Their income. Their investments. Their businesses. Their retirement plans. Their family finances. Their Social Security numbers.
Sometimes even their personal struggles and financial worries.
They share this information because they trust you.
And that trust carries an extraordinary responsibility.
Last week’s PHP security vulnerabilities were a reminder that even established, widely used technologies can have serious security problems.
No software platform is immune to vulnerabilities.
No security system is perfect.
And no amount of technology eliminates the need for professional judgment and accountability.
The difference is whether a firm has the people, processes, and safeguards in place to identify risks and respond responsibly.
So here’s my advice.
Take an afternoon.
Review your website.
Ask your technology providers some difficult questions.
Update your WISP.
Review your client communication policies.
Understand what information your AI tools are accessing.
And make sure somebody is accountable for keeping your firm’s security practices current.
You don’t need to become an IT expert to run a modern practice.
But you do need to understand enough to ask the right questions.
Because the future of tax and accounting isn’t just about working smarter. It’s about earning and protecting the trust that makes smarter technology valuable in the first place.
And that’s a responsibility none of us should take lightly.
Frequently Asked Questions
What were the October 2026 PHP security vulnerabilities?
On October 21, 2026, the PHP project released emergency updates addressing CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities received critical severity ratings of 9.2 and could potentially permit unauthorized code execution in affected server environments. On October 23, the project published an additional advisory concerning CVE-2026-115560, which involves a less common configuration and requires separate mitigation pending a regular software release.
Are WordPress websites affected by the PHP vulnerabilities?
WordPress relies on PHP, so websites running affected PHP versions may be exposed. Actual risk depends on the PHP version and server configuration. Updating WordPress plugins or themes does not patch vulnerabilities in the underlying PHP runtime. Firms should contact their hosting provider or website administrator to verify their software versions and remediation status.
Are tax and accounting firms required to have a Written Information Security Plan?
Tax preparation businesses covered by the FTC Safeguards Rule must maintain an appropriate written information security program. The IRS also reminds tax and accounting professionals of their legal responsibilities to protect confidential taxpayer information and offers Publications 4557 and 5708 to help firms develop and maintain a WISP.
How often should a tax firm update its WISP?
Firms should review their security plans regularly and update them when meaningful changes occur in technology, employees, vendors, operations, or security risks. The introduction of new AI applications, client communication tools, or cloud services should prompt a review of the relevant security policies.
Can accountants and tax preparers use ChatGPT or other AI applications with client data?
AI applications can be valuable professional tools, but firms must comply with applicable confidentiality and privacy requirements. Section 7216 restricts certain uses and disclosures of tax return information. Firms should review applicable exceptions, consent requirements, vendor data-handling practices, and security safeguards before submitting confidential information to an AI provider.
Does tokenizing client information make it safe to use with AI?
Tokenization can reduce unnecessary exposure of personal identifiers by replacing them with substitute values. However, tokenized information may still be sensitive or subject to legal restrictions. Tokenization does not automatically satisfy Section 7216 or eliminate the need to evaluate applicable privacy and security obligations.
What does the FTC Safeguards Rule require of tax preparation businesses?
Covered businesses must maintain appropriate information security programs. Depending on applicable provisions and exceptions, requirements include risk assessments, access controls, encryption, multi-factor authentication, employee training, vendor oversight, security testing, and incident response procedures.
What should a tax firm do if its website runs outdated PHP?
Contact the hosting provider or website administrator. Verify which PHP version is installed, whether it is affected by known vulnerabilities, and whether appropriate security updates or vendor-supported fixes are available. Unsupported installations may require migration or replacement. Temporary configuration changes should not be treated as permanent substitutes for necessary security updates.
Does a secure software provider eliminate a firm’s cybersecurity responsibilities?
No. Technology providers are responsible for the protections and services they contract to provide, but covered firms retain their own obligations under applicable laws and regulations. Firms should understand how vendors protect information, review service-provider arrangements, and maintain appropriate internal policies and oversight.
Should tax and accounting firms have cybersecurity insurance?
Cyber liability insurance can help organizations manage certain financial consequences of cyber incidents, depending on policy coverage and conditions. Firms should review their coverage with qualified insurance advisers and verify that their actual security practices are accurately represented in insurance applications and renewals.
‍
