In short: For a property manager's IT security, what counts above all are the systems through which tenants and owners submit data: portals, damage reports and application forms for flats. Clarify which of them run on your own server, have the PHP patch confirmed, and keep a fallback route ready for urgent damage reports.
Which PHP systems property managers and estate agents use
Many managers work with industry software for properties, rents and service charges. Outwardly, further systems come in: tenant and owner portals with document storage, online forms for damage reports with photo upload, flat listings with an enquiry form and tenant self-disclosure, and areas for owners' meetings with minutes and resolutions.
Some of this is operated as a service by the software vendor, some runs on your own website, often WordPress with real estate plugins. For PHP2Shell, exactly this distinction is decisive.
Then there are interfaces that hardly anyone notices in daily work: property listings are transferred automatically from the industry software to the website and to property portals, meter readings come from metering service providers, tradesperson orders run through dedicated forms. Each of these connections needs credentials, which are often stored on the web server. After an incident they all have to be renewed, otherwise the attacker keeps a back door into adjacent systems.
Which data tenants and owners entrust
A property management holds tenancy agreements, bank details for direct debits, service charge statements, meter readings, correspondence on defects and disputes, and photos from flats. For prospective tenants, self-disclosures with proof of income, ID copies and credit reports come in addition. In owner portals there are resolutions, reserves and sometimes information on locking systems.
For attackers this data is interesting for two reasons: it enables identity abuse, and it supplies everything needed for credible fraud emails, such as an alleged new bank account for the rent. Uploaded files are, moreover, a typical attack route. How to implement uploads securely is explained in the guide File uploads in PHP.
Property management and IT security: what an incident means
If the portal goes down, the channel for urgent reports such as water damage or heating failures is missing. That creates pressure on the phone and the emergency service, but is plannable. More dangerous is an attack that goes unnoticed:
- Tenants receive forged payment requests with a foreign IBAN that cite real contract details.
- Self-disclosures from flat applicants are copied and used for fraud.
- Owners lose trust in the management, which becomes an issue at the next meeting.
If there are indications of a data leak, a report to the supervisory authority under the 72-hour rule of the GDPR may be required. You make the assessment with your data protection officer.
If nobody confirms that PHP on your portal's server is patched and restarted, take the portal offline. Redirect damage reports to the phone and the emergency service in the meantime.
The typical responsibility gap
| System | Operation | Who patches PHP |
|---|---|---|
| Industry software in the office | IT support | usually not affected |
| Portal as a vendor service | Software vendor | Vendor, request confirmation |
| Portal on own server | Host or service provider | As per contract, often unclear |
| Website with flat listings | Agency and host | Host with web hosting |
On top of that, in smaller managements nobody has the overall view. The agency knows the website, IT support the office PCs, the software vendor its portal.
Involving owners, advisory boards and tenants properly
In condominium (WEG) management, owners and advisory boards are not only those affected but also the client. They rightly expect the management to report openly and verifiably in an incident. A short report with the cause, affected systems, measures taken and open status is better than silence until the next meeting.
Tenants above all need practical guidance: which reporting route currently applies, that bank details do not change by email, and to whom they can pass on suspicious messages. Coordinated texts prevent caretakers, case handlers and accounting from giving different information.
The first hours for management
- List all portals and forms and clarify for each where it runs.
- Have the patch level at 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a backport, and the restart confirmed in writing.
- Preserve logs from 20 October 2026 onward and have upload directories checked for unknown files.
- Check staff accounts on the portals and, after the cleanup, secure them with two-factor login.
- As a precaution, point out to tenants that bank details do not change by email.
How does PHP SOS help?
- We record your portals and forms and clarify responsibilities with the vendor, agency and host.
- We check patch level and restart and examine upload folders and databases for webshells.
- In case of an infection, we clean up as part of the emergency help for hacked websites and document the incident for the data protection officer and insurer.
- With a security maintenance contract, PHP on your servers stays permanently up to date and monitored.
Frequently asked questions
Our tenant portal is software from a vendor. Are we affected?
If the portal runs as a service at the vendor, the vendor is responsible for the server and PHP. Ask there in writing about the current status. If the same software runs on your own server or at your host, the patch and restart are with you or your service provider.
Which data from the tenant self-disclosure is particularly sensitive?
Proof of income, copies of ID documents, credit reports and details about the employer lend themselves to identity abuse and fraud. They should only be stored for as long as is necessary for the letting. How long that is, you clarify with your data protection officer.
How do we prevent forged payment requests to tenants?
Tell tenants that your bank details will not change by email or portal message without you confirming it by a second route. After an incident you should warn tenants actively. Technically, hardening the portals and two-factor login for staff accounts help.