1. Red
  2. Learn
  3. Agencies and MSPs

Agency and MSP website security: client sites, evidence, contracts

Security guidance for web agencies and MSPs running many client sites: PHP2Shell triage, management plugin risk, client emails, liability and scan reports.

An agency or MSP holds administrator access to dozens of sites it does not own. One flaw in a shared tool, a host, or the PHP runtime under every client reaches all of them at once, and each client still expects an answer about their own site. This page collects what agencies need to check, prove and say, with the sources behind each point.

What matters right now

  • PHP2Shell. CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote code execution in PHP core. The PHP project notice lists fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to AWS, honeypot attempts began on 17 October. Neither CVE was in CISA KEV at our 22 October check.
  • UpdraftCentral keys. TeamUpdraft says its customer database was accessed, including connection keys, in an incident statement dated 19 October and updated to 22 October. Updating the plugin closes code flaws. It does not revoke a stolen key.
  • Management plugin flaws. ManageWP Worker had CVE-2026-18052, fixed in 4.9.37. MainWP Child had CVE-2026-12255, fixed in 6.1.2. Both are CVSS 8.1 and sit on every connected client site.
  • Host answers are not evidence. Distributions and panels backport fixes without changing the version number, so a banner can mislead in either direction. Ubuntu's PHP2Shell notice shows the package names that count.

Where to start

  • If PHP2Shell is the question this week, start with client triage and the evidence list.
  • If you connect clients through a remote dashboard, read the single point of failure risk.
  • If a client has asked "are we affected?", use the email templates for five situations.
  • If you manage about 30 WordPress sites and are pricing tools, see what to use instead of per-site licences.
  • If a client site has already been hit, read who is liable and which contract clauses help.
  • If you want to test client sites, read how to get permission and scope the work.
  • If you are building a scan service, see the report clients can forward.
  • If you are weighing a reseller partner, compare white-label pentest and automated scanning.

Red's free scan reads a site's stack from outside and matches versions to known vulnerabilities, one per domain, no card.

Every agencies and msps guide

1 article, newest update first. Each one is dated and points at its primary sources.

Check your own site

The free scan reads the stack your site serves and matches each version to known vulnerabilities. Updated 24 October 2026.

Other topics