Security advisory: critical flaw affecting websites (PHP2Shell)
On 21 October the PHP team released emergency fixes for two critical security flaws, known as PHP2Shell. PHP is the software behind around 70% of websites, including WordPress, WooCommerce and many customer portals. The flaws let an attacker take over a web server with a single request and no password, and attackers started trying them before the fixes were even out.
If you have a website, online shop, customer portal or similar, it very likely runs on PHP and needs updating now. Updating WordPress or its plugins is not enough. The PHP underneath has to be updated by whoever runs the server.
What we'd ask you to do:
1. Today, forward the attached advisory to your IT team, web agency, hosting company or IT provider. Ask them to confirm in writing, with a date, that PHP is updated on every site and that they've checked for any signs of compromise.
2. Include the sites people tend to forget: old or test sites, staff and customer portals, webmail and billing systems.
3. If you're told a site runs PHP 8.1 or older, there's no official fix coming. It needs upgrading, so plan that now.
4. If a site can't be updated straight away, ask for access to it to be restricted or for it to be taken offline until it can.
5. Ask the same of any supplier that hosts services or data for you.
Where we manage systems on your behalf, we're already checking those for PHP and watching for signs of attack. Everything else, including systems run by your IT team, web agency, hosting company or suppliers, still needs checking.
If you'd like help finding where PHP runs in your business, just contact us.
