Last week a serious security flaw turned up in PHP, the software that quietly runs most of the web, including nearly every WordPress site.
For a few days it was the biggest story in web hosting. There’s a decent chance you didn’t hear about it at all.
That’s fine. You shouldn’t have to follow this sort of news. But last week is worth five minutes of your time, because it showed exactly what the difference is between a website somebody looks after and a website nobody does.
What actually happened
PHP is the programming language behind roughly 70% of the web, so a serious flaw in PHP is a serious flaw in most websites you’ve ever visited. On Tuesday 20 October, security researchers announced exactly that: a pair of critical vulnerabilities, nicknamed PHP2Shell, of the worst kind there is. In plain English, they could let an attacker run their own code on your server and, in effect, take it over.
Fixed versions of PHP were released on Wednesday 21 October, and hosting companies around the world spent the rest of the week racing to install them.
Why any of this matters to you
It’s tempting to think of a website as a thing you bought once, like the sign over your door.
It isn’t. A website is software sitting on a pile of other software: something like PHP underneath, perhaps WordPress on top of that, plugins and themes on top of that, all of it on a server that needs looking after too. Every layer sometimes needs updating – and every so often one of them needs updating urgently.
Last week the urgent layer was PHP. The question was never whether your site was affected, because if it runs WordPress, it almost certainly was. The question was whether anyone noticed, and how quickly they acted. That gap, between the fix existing and the fix being on your site, is where the trouble happens. Attackers read security announcements too, and they move fast precisely because they know plenty of websites have nobody watching.
Website maintenance can be stress-free
Here’s the complete list of things our customers on our support plans had to do about PHP2Shell…
Nothing.
No logging in, no emergency plugin, no taking the site down.
We wrote up what we did and when as it happened. The short version: protective firewall rules were in place for every customer before the fix even existed, and we tested the patched PHP versions against our own setup before rolling them out, rather than firing an untested update at everyone and hoping. By the time most people had read a headline about it, it was already handled.
And that’s the real point. When a website is looked after properly, a week like this doesn’t cause stress – it barely registers.
Five questions to ask whoever looks after your website
If you’re not sure if someone’s looking after your website for you, these are worth asking this week, while the news is fresh. None of them needs any technical knowledge, and neither should the answers.
- What version of PHP is our site running, and is it still supported? (Versions 8.1 and older no longer get security fixes.)
- When PHP was patched on 21 October, when was our site updated?
- Who installs security updates generally, and how quickly after they come out?
- Is there a firewall in front of the site that can block attacks before a fix exists?
- If the site were compromised tomorrow, who would restore it, and how old would the backup be?
You’re not looking for jargon. You’re looking for a straight answer, given quickly, by someone who clearly didn’t have to go and check whether your website exists. If nobody can give you one, that in itself tells you something.
The tool is never the point
We’re not telling you to fear PHP or WordPress because of one bad flaw. They’ve run most of the web for twenty years and will carry on doing so. Flaws get found in every platform. What matters is what happens next.
Your website shouldn’t depend on you reading security news. It should depend on an arrangement: somebody, named and reachable, whose job it is to keep the lights on.
Maintenance is the least glamorous thing we offer, and last week it was the most valuable.
If you asked the five questions above and didn’t like the silence, we should talk.