On Wednesday 21 October, the PHP security team released fixes for two critical vulnerabilities. We patched our servers the same day, so all of our hosted customers were protected without needing to do anything.
What happened
PHP is the programming language that powers a huge number of websites, including most of the sites we build and host. On Tuesday 20 October, the PHP security team announced that fixes for two critical vulnerabilities would be released the following day at 3pm UK time.
Both vulnerabilities were rated 9.2 out of 10 for severity. They sit in PHP itself, which means every website running PHP was potentially affected, whatever it was built with. In the worst case, they could allow someone with no account and no access to a website to run their own code on the server. The PHP team confirmed that updating is the only complete fix.
What we did
We were ready before the announcement. Working with our server provider, we began rolling out the fixed PHP packages as soon as they were published on Wednesday. Every one of our servers was patched within a couple of hours, with no downtime, so customers’ websites stayed online throughout.
Some websites run on older versions of PHP that are now end of life and would not normally receive a fix like this from PHP. On this occasion, due to the severity, older versions were patched too, so every site we host is covered.
As an extra precaution, we also switched off a PHP feature (session upload progress) that attackers could have used as one route into a server.
Extra layers of protection
Patching is the fix, but we never rely on a single line of defence. Our servers also run Imunify360, a security platform that includes a web application firewall. Within hours of the news breaking, Imunify360 began automatically blocking known attack requests aimed at these vulnerabilities, including a publicly available exploit tool, and challenging IP addresses seen scanning for weaknesses. This protection was in place on our servers before the PHP fixes were even released.
Websites that also run through Cloudflare had another layer on top. Cloudflare switched on protections against these vulnerabilities by default, ahead of the public release, for customers on every plan including the free tier. Cloudflare and Imunify360 both describe these rules as a safety net rather than a replacement for patching, which is why we updated PHP on every server as well.
Why it matters
Security updates like this are a routine but vital part of keeping websites safe. Monitoring for them and applying fixes quickly is a core part of our hosting and support service, and it is one of the main reasons we manage this for our clients.
This is exactly why managed hosting matters. Most website owners have no reason to follow PHP security announcements, and they should not have to. With managed hosting, a dedicated team is always keeping an eye on them for you, applying fixes across every server and website as soon as they are available and adding extra layers such as firewalls on top. Problems are dealt with proactively and often before anyone has noticed there was one, so you can get on with running your business without having to worry about it.
Looking for a team to look after this for you?
If you are responsible for a website that is hosted elsewhere and you are not sure whether it has been updated, or you would simply like a team to take care of this for you, we would be happy to help. Get in touch and we can have a friendly chat about how we can keep websites secure and running smoothly.
If you have any questions about this update or the security of a website you manage, please get in touch with the team.