6 in 10 BC Law-Firm Websites Run PHP, and Other Things I Learned Racing a Security Advisory

BREAKING: A man in British Columbia has read 446 home pages and lived to write about it.

By Mackenzie Bowes · mackenzie@mackenziebowes.com · @_mackenziebowes on X

Seven and a half hours. That's how long PHP gave the internet before I started counting.

On 21 October 2026, PHP shipped a fix for two memory-safety bugs in its C core - the kind of bug where a stranger with no password may be able to take over a server with a single request. At 12:43 PDT I ran a quick 13-site check in Victoria to see if this was even a story. It was. At 13:56 PDT, I started the real scan.

By the end of the day I had read 446 BC law-firm websites, once each. Here's what came back:

Let me translate that funnel for you:

• 62% of BC law-firm websites run PHP - and 271 of those 278 are WordPress. If you thought the "is WordPress still everywhere?" debate was settled, the legal profession would like a word.
• 73% hide their version. Good for them! It also means nobody - not an attacker, not me - can tell whether they're patched. Only their hosts know.
• Of the 74 that did show a version, 89% were below the fix or on a branch PHP no longer supports. Eight sites were patched. Eight. I want to buy those eight hosts a drink.
• Canada-wide, the picture is the same: 3,114 law-firm sites, 60% on PHP, 72% hiding the version, 91% of the version-showers unpatched or unsupported.

And here's the part that should make a builder's ears perk up: these sites collect intake forms. Names, matter notes, the things lawyers are professionally obligated to protect. The Law Society of BC's Rule 10-4 says a lawyer "must protect all records related to the lawyer's practice... by making reasonable security arrangements." An intake form's submissions landing on an unpatched PHP server is, as we say in the business, a finding.

How the census actually worked (the part you're here for)

No scraping empire, no paid data, no exploit. The recipe:

1. Frame it. Every OpenStreetMap law office in Canada with a website, plus every .ca domain in Common Crawl's May - July 2026 web graph with a law word in its name. A site counts as BC when its home page has law words and a BC postal code.
2. Read one page per site. Home page only. Honoured robots.txt. Tried no exploit. Named no firm. (This is not just ethics - it's also how you avoid becoming the story.)
3. Validate your classifier. I hand-checked 50 randomly drawn sites. 48 were BC law firms; the other two were a medical-legal society and a notary. If you're going to publish shares, know your error rate.
4. Admit it's a floor. Of 40 sites the scan couldn't place, at least 15 were law firms with no address on their home page. The frame also favours firms whose .ca domain says "law." So: these are the websites I could find, not every firm. Say so out loud. Your numbers get more credible, not less.

Total elapsed time from advisory to published page: same day. That's the whole trick. Censuses are cheap, nobody does them, and the news cycle is a countdown timer on their value.

The business lesson hiding in the funnel

Here's what I actually sold with this scan. Not data - a checklist:

1. Check the version. On WordPress: Tools > Site Health > Info > Server. On cPanel: MultiPHP Manager. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.[1]
2. Email the host, in writing. (Lawyers love "in writing." It's the one file format they never complain about.)
3. File the reply with today's date. If it promises an update date, diarize it and check again.

And the kicker, delivered with a straight face: both bugs are memory-safety bugs in PHP's C core, and AI tools are making that class of bug cheaper to find - for attackers and defenders. There will be another advisory. A site built as static files has nothing to patch when it lands. That's what I build. The scan isn't just content; it's a demonstration of the product.

Your turn

Pick a niche - dentists, accountants, realtors, anyone with a form and a regulatory duty. Pick a checkable fact - PHP version, TLS config, anything a home page will tell a polite visitor. Run the census the day the news breaks. Validate 50 by hand. Publish the honest floor. Offer the fix.

Six in ten of them are running PHP. Somebody in your niche is too.