This week’s PHP security alert: what it means for your business website

This week, the people who look after PHP announced two critical security flaws in PHP itself. PHP is the programming language that runs most of the websites on the internet, including every WordPress site. The flaws, which have been nicknamed PHP2Shell, let an attacker run their own code on a website's server without signing in to anything.

The response has been unusually strong. Government websites in the Netherlands, Finland, France and Australia were taken offline while the fix was prepared. The US cyber security agency CISA has told organisations to install the update quickly, and security researchers reported attacks under way before the fix was even released. One researcher's advice: if you have a public PHP site and have not updated it, assume you are exposed.

OpenAI says one of its AI models found the problem ahead of the attackers. That is good news this time. It is also a sign that flaws in older, widely used software are going to be found faster from now on, by both sides.

If you run a business website, here is what to do.

1. Find out whether your website runs on PHP

If your site is built on WordPress, Joomla, Drupal or Magento, it runs on PHP. So do many sites built by a web designer or developer on their own system. If you are unsure, ask whoever built it or whoever hosts it.

Sites on hosted platforms such as Squarespace or Wix are looked after by the platform, and there is nothing for you to update.

2. Ask your host or developer one question today

"Has PHP on our site been updated to the fixed version, and when?"

A good answer is a yes with a date. Many hosting companies update PHP for you, but not all of them, and not always for every site on their servers. The fixed versions are PHP 8.2 and newer. Versions 8.1 and older are past their end of life and are not expected to get a fix at all, and plenty of sites built a few years ago still run on them. A site like that may need work before it can move to a version that is fixed, and that work is worth doing now.

3. If nobody answers, treat it as urgent

This is where many businesses find out who looks after their website. If the designer who built it has moved on, or the hosting account is in someone else's name, you may not be able to make the update yourself. Our check on who holds the keys to your website takes about ten minutes and shows you where the gaps are.

If you cannot get it updated quickly and the site handles anything sensitive, such as customer details or payments, taking it offline for a few days is a reasonable step. That is what several governments chose to do.

4. Look for signs that something has changed

Because attacks started before the fix was out, it is worth checking. Ask whoever looks after the site to look for administrator accounts nobody recognises, plugins or files that were not there before, and pages or links you did not add. Make sure there is a recent backup from before this week, held somewhere other than the website's own server.

Is it time to move away from PHP?

It is a fair question. Our answer: not because of this alone.

Every technology has serious flaws from time to time, including the one we build with. PHP is mature, widely supported and fixed quickly when something goes wrong, as this week shows. A PHP site that is kept up to date by someone who is paying attention is in a good position today.

The sites in trouble this week tend to have something else in common: nobody is looking after them. They run an old version of PHP, old plugins and an old theme, because the site was finished, paid for and left alone. That is the problem worth solving, whatever language the site is written in.

There are still good reasons to choose newer technology when you rebuild. Websites built with modern tools such as Next.js can prepare most of their pages in advance, so a visitor is sent a finished page rather than having code run on the server for every visit. There is less running in public and less to attack. Updates to the code are tracked, tested and published in minutes, so a fix like this week's can be live the same day. These are real advantages, but they only help if someone is responsible for making the update.

So the question to ask about your website is not "which language is it written in?" It is "if a problem like this turned up tomorrow, who would fix it, and how quickly?"

If you would like someone to look after it

We build fully custom websites and software that you own outright, with the accounts in your name. Through our Skills Retainer we also look after them each month, which includes keeping everything up to date. If this week has made you wonder about your own site, get in touch and we will tell you what we see, even if the answer is that it is fine as it is.