Already protected: ABA Fieldwork Tracker’s rapid response to PHP2Shell

When PHP2Shell made the news in October 2026, ABA Fieldwork Tracker users were already protected. The app is built with layers of protection for days like this. Our development team still moved right away: within hours, our team had further strengthened the systems behind ABA Fieldwork Tracker, tested everything, and confirmed your data was safe and sound. Your fieldwork records are exactly where you left them, and there is nothing you need to do.

How quickly did ABA Fieldwork Tracker respond?#

Within hours, our team had further strengthened the systems behind ABA Fieldwork Tracker, tested everything, and confirmed your data was safe and sound. On October 21, the day PHP released its update, the team:

• Looked closely at the news and reviewed every protection around your data.
• Added further protection to the systems that run the app.
• Tested the app to make sure everything worked just as it should.
• Ran a full check for any sign of trouble, and found none.

When security news breaks, a quick response matters. If you are choosing a fieldwork tracker, an RBT® tracker, a supervision platform or a platform for your organization, ask how quickly they responded to PHP2Shell and what they checked. A team that can answer clearly is a team you can trust with your record. Our guide to choosing a BACB fieldwork tracker covers the rest of what to look for.

What this means for your fieldwork records#

Your hours, supervision, signatures and forms are exactly where you left them. Every entry you have logged, every month your supervisor has signed and every form you have created is just as it was. There is no password to change and nothing you need to do.

Your connections with your supervisors and trainees are unchanged too, and the app works exactly the way it did before. If you are in the middle of a month, keep logging the way you always do: your progress, your supervision and your forms all pick up right where they are.

If you ever have a question about your account, our team is one message away from inside the app.

The protection working behind the scenes#

None of this protection was added for the headlines. It has been part of how ABA Fieldwork Tracker is built from day one:

• A security shield in front of the app. Every visit to ABA Fieldwork Tracker passes through Cloudflare, a security service trusted by millions of websites. With rules we set up just for ABA Fieldwork Tracker, it turns away suspicious traffic before it ever reaches the app.
• A secure connection. The app only uses a secure connection, the padlock in your browser, so everything you send is scrambled on its way to us.
• Encryption. We use encryption to keep your data protected.
• Backed up off-site. Your data is backed up automatically to secure storage in a separate location, so your record never depends on a single computer.
• Strong sign-in protection. Your password is never stored the way you typed it, every account confirms its email, too many wrong guesses are blocked, and you are signed out automatically after a while without activity.
• You decide who sees your hours. A supervisor sees your record only after you connect, can only view it, and either of you can end the connection anytime.
• A team that keeps watch. We keep the systems behind the app up to date and check every change for security problems before it goes live.

We never sell your data, and there are no ads. More on all of it on our security page.

PHP2Shell explained in plain English#

PHP is software that powers a large share of the websites and apps people use every day. PHP2Shell is the name given to two serious flaws found in it. On a website without the right protection, they could have let an outsider take control of it.

Think of a whiteboard that should be wiped clean after every meeting. The flaws meant a few notes could be left behind, and someone who knew the trick could use them to sneak in instructions of their own. PHP announced the flaws on October 20, 2026, released an update on October 21, and websites around the world moved quickly to protect themselves. For the technical details, see PHP’s security advisory.

A few simple ways to protect your account#

These are everyday good habits for any account you care about, not extra steps because of PHP2Shell:

• Use a password that is yours alone. A password you use nowhere else keeps your fieldwork record safe even if another site you use has a problem.
• Keep your email secure. Your email is how you reset your password, so give it a strong password of its own.
• Connect only with supervisors you know. You choose who sees your hours, and you can end a connection anytime.

Your fieldwork is important to us, and we’ve got your back#

Every hour you log is part of years of hard work toward your certification and your career. Protecting that progress is one of the most important things we do, and your data is safe and sound.

When PHP2Shell was announced, our team did not wait. They reviewed the protections around the app, took extra steps to strengthen them, and checked that everything was right. That is how we will keep showing up, quickly and quietly, so you can keep your focus on your clients and your growth. Thank you for trusting us with your fieldwork.