Following the disclosure of the PHP2Shell security vulnerabilities on October 21, 2026, our Security and Engineering teams assessed their impact and took action to address affected systems.
SimplePractice is not affected
The SimplePractice platform does not use PHP and is not affected by these vulnerabilities. You don’t need to take any action to address PHP2Shell in your SimplePractice account.
Track Your Hours was patched
Track Your Hours, a separate platform from SimplePractice, used an affected version of PHP. As a precaution, we temporarily took it offline while we implemented a security update. The platform was patched and service was restored on October 21, 2026.
Our security controls blocked all detected attempts to probe the vulnerability before the update. We have not identified evidence of successful exploitation of the Track Your Hours platform.
Our commitment to security
Protecting your practice and the information entrusted to us is a priority at SimplePractice. We take emerging security threats seriously and are committed to responding promptly, strengthening our safeguards, and communicating transparently about issues that may affect our customers.