What the Hell is PHP Anyway?
PHP is one of the oldest scripting languages used on the World Wide Web. It essentially lets the server do some processing and then sends the result to the browser. Everything from your CMS (like WordPress), to your online shops, to Wikipedia runs on PHP. It’s easy to use, it’s free, and it’s compatible with almost everything, so there’s no surprise it’s ubiquitous and used on literally millions of web servers around the world. It’s also largely considered safe for all sorts of use.
Then this week, an emergency patch was released for a critical vulnerability in PHP. This vulnerability essentially opened a path for an attacker to take control of the server’s operating system, giving them complete access to everything. The flaw, named PHP2Shell by the community, was leaked prior to the patches being released. This very quickly led to millions of attacks being made. Here’s the CEO of Cloudflare (which handles around 20% of all websites in the world).
This isn’t the first time such a flaw has been uncovered. Back in 2014, the OpenSSL cryptography library that governs how a private connection between a browser and a server works was found to have a flaw. This was the Heartbleed Bug and meant that attackers could read sensitive information straight out of the server’s memory. Then there was the Log4Shell issue in 2021, where a Java logging utility could be exploited to give an attacker full remote control of a server.
But It’s Fixed Now, Right?
Yes and no. Many servers have been patched, either by the hosting company or the website company running them. Almost all of our servers were patched within 24 hours, and we’ve seen no evidence of attacks made against them.
The problem is that the fix has only been released for current versions of PHP, which is versions 8.2 and later. Servers running older versions had to be upgraded to a newer version.
This causes its own problem. Websites that use PHP might find that certain functionality they require has been changed between the version they were written for and the currently patched versions. Just like some apps stop working because they’re set up for a different version of your phone’s operating system. So if you don’t upgrade your phone to one that can run the newest version of iOS or Android, you’ll find you can’t use those apps. The same thing happens with websites; the software running on the server gets patched, and suddenly your website doesn’t work anymore.
It might not be a complete failure of your website, it could be that certain features suddenly don’t work. Your admin login doesn’t work, or the checkout fails at a critical point, or the search function stops returning any results. This is because it wasn’t written for the version of PHP it finds itself running on, and while most of it is much the same, there are sufficient differences that functions stop working.
You’re Going to Tell Me to Update My Website Aren’t You?
Well… yes. More, we’re going to tell you to always keep your website up to date. This problem might be resolved now, but there will be others. With the automation capabilities of AI, hackers (both good guys and bad) are finding new vulnerabilities and exploits all the time, and it’s only going to get worse.
Keeping your website running on the latest version of the software (both the CMS - Content Management System - and any plugins), means we can keep the server running on the latest version of all the software it needs. That’s not just PHP, that’s the operating system, the actual web server software (like Apache or NGINX), the databases, everything. That means when something like this happens, it’s a five minute fix, not a five hour task.
It also protects you from older exploits which might not be as well known. Flaws and bugs in software are found all the time and are quietly fixed in newer versions. Keeping up to date with this progress means your website is as safe as it can be. This is especially important if your website hold any data about your customers. Online shops are the most common example here; you’re holding names, emails, phone numbers, and maybe physical addresses for hundreds or thousands, or maybe tens of thousands of people on your web server, which could be vulnerable if you don’t keep your systems up to date.
It might not be cheap. It might not be something you even think about until something like this happens. But it’s certainly cheaper than actually having your web server compromised. And the time between one of these flaws being exposed and being exploited is measured in hours, not days.
