A serious security flaw in PHP was announced on 21 October, and lots of websites were left vulnerable. If your website runs on PHP, you will want to know whether yours is one of them. Here is what happened, what we have done for our clients, and how to check your own site.
What Happened
On 21 October, security vulnerabilities in PHP were announced, with the flaw identified using AI. PHP is the programming language that a huge number of websites run on, including WordPress and Joomla sites. Lots of websites were left vulnerable because their servers were not running supported versions of PHP.
What We Have Done
Our team had mitigations in place before the official fix was released. Once the patch release became available on 21 October, we patched our servers with the officially supported release for versions 8.2 and above, and backported the security fixes for end-of-life versions from 5 to 8.1. Our team then spent the day upgrading many of our sites, and patching those that are not yet ready to be upgraded.
The result is that every Channel server is now on a fixed PHP build, so you are protected against the announced PHP vulnerabilities.
What About Older Websites?
For sites running on older versions of PHP (usually 7.4 or 5.6, and certainly anything lower than 8.2) there is no official security release from PHP.net, so the security fixes have received “backported” patches. This means we have taken the fix from the new release and applied it to the older version, so the site is still protected.
As you can see, though, it is not ideal to stay on outdated versions of PHP. To take advantage of the security of an official, up to date PHP release, your website will need to be upgraded to a new site. Ignore this at your peril, because the next vulnerability will arrive eventually, and an old version will not get an official fix when it does.
Questions to Ask Your Host
Not sure whether your website is secure? If we don’t host your site, your host is the place to start. Here are the questions to put to them. A good host should be able to answer all of them without much fuss.
- Does my website run PHP?
Many sites do, including WordPress sites. Ask your host to confirm, as it is the quickest way to find out whether this affects you at all. - Exactly which version of PHP is my site running?
Ask for the full version number, not just “PHP 8”. The exact version matters here. As a rule of thumb, anything lower than 8.2 (usually 7.4 or 5.6) is an old version and will need attention. - Has the security fix been applied, and what version is the site on now?
A fixed PHP build was released on 21 October. Ask your host whether it has been applied to your server and what version you are running as a result. If the answer is “we are looking into it”, that tells you something too. - When was the fix applied?
Ask for the date. Our own servers were patched once the patch release was available on 21 October. - If my site is on an old version of PHP, how is it protected?
Old versions of PHP do not get an official security release. Some hosts will “backport” the fix, which means taking the fix from the new release and applying it to the older version. That is what we have done for older sites on our servers. Ask your host whether they have done the same, or whether your site is simply exposed. - Is there any sign my site has been attacked?
Ask whether your host has seen any evidence of exploitation or unusual web server activity. Hosts should be willing to tell you what they have checked. - Does my site need upgrading?
Backported fixes are a safety net, not a long-term plan. Sites on outdated PHP versions will need upgrading to a new site to take advantage of an official, up to date PHP release. If your host says this, it is worth listening to.
Summary
Every Channel server is protected against the announced vulnerabilities. Sites on older PHP versions are protected by backported fixes, but they will need upgrading to a new site to get the full benefit of an official release.
We are more than happy to help with upgrading, or building a brand new up to date website. Contact Us today for a no obligation chat.
