Last Tuesday the PHP project released emergency fixes for two critical security flaws, now known as PHP2Shell. Within days there was confirmed exploitation in the wild, and a number of businesses and several governments took their own websites offline while they patched. It was one of the rare instances of a technical IT story making headline news.
PHP is the programming language that runs most of the web - 70% is the often quoted figure - and that includes WordPress, Joomla, Drupal and Magento, which between them power an enormous number of small business websites. If your site was built on one of those, this is relevant to you.
The bit to forward to your boss
If your website runs on PHP, the server it sits on needs updating to a fixed version of PHP. You probably can’t do that yourself - your web host or developer can. Ask them to confirm it’s been done. If you don’t know who built your site or where it’s hosted, that’s the first problem to solve, and we can help with that - get in touch sooner rather than later.
What’s the actual problem?
The two flaws allow someone on the internet to send a particular “message” to an affected web server which allows them to run their own code, without having logged in first. Once they can do that, they effectively own the server: they can deface the site, steal whatever data is on it, plant malware for your visitors, or use the server to attack other things - and if that happens you’ll probably also find Google starts warning your customers away from your site.
The flaws are in PHP itself rather than in WordPress or any particular plugin, so a perfectly well-maintained WordPress site can still be vulnerable if the server underneath it hasn’t been updated. Researchers have already shown working attacks against WordPress, Drupal, Joomla and Magento.
Why small business sites are particularly exposed
Big organisations have teams watching their servers. A typical small business website doesn’t. It was built a few years ago, it works, and nobody has thought about it since.
That causes three common problems.
Lost contacts. We regularly come across businesses whose website was built by a freelancer who’s since moved on, or an agency that no longer exists, with hosting paid for on a card nobody recognises. No-one knows where the site runs but it runs quite happily right up until it doesn’t.
Old PHP versions. Many sites are deliberately kept on an older version of PHP because a theme or plugin broke the last time someone tried to upgrade. PHP 8.1 and older are no longer officially supported, and versions before 7.4 won’t get a fix at all. Some hosts maintain their own patched builds of older versions, but you need to ask - don’t assume. Keeping a WordPress site’s core, theme and plugins in step is a job in itself, and it’s part of why we didn’t build our own site on it.
Unclear responsibility. On shared hosting, the host usually manages PHP but many let you choose which version your site uses from the control panel. On a private server, it’s often nobody’s job unless someone specifically agreed to it. The developer assumes the host is patching it, the host assumes the developer is, and you assume at least one of them is.
If your site is on a fully hosted platform like Wix, Squarespace or Shopify, the platform handles the underlying servers, and patching this is their job, not yours.
Questions to ask your web host
You don’t need to understand the technical detail to get useful answers. Send your host (or developer) these:
- Has the PHP on my server been updated to a fixed version, and when was it done? You’re looking for 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
- Which PHP version is my site actually running? It may not be the newest one on the server.
- If it’s older than 8.2, is it running a patched build - and what’s the plan to move it to a supported version?
- Is my site on shared hosting or its own server, and who is responsible for applying updates to it? Get the answer in writing.
- Have you checked for signs the site was compromised before it was patched? Attacks were seen several days before the fixes were public, so “it’s patched now” isn’t quite the whole answer.
- When was the last good backup taken, and where is it stored? If the worst has already happened, that’s what you’ll be restoring from.
A good host will answer those quickly and without fuss. If yours can’t, or won’t, that tells you something useful too.
If you don’t know who to ask
If you can’t contact whoever built your site, don’t know where it’s hosted, or don’t know what it runs on - get in touch. We can usually work out where a website lives and what’s underneath it fairly quickly from the outside, and then help you get it patched, moved or rebuilt depending on what we find.
The UK’s National Cyber Security Centre has advised that systems which can’t be patched promptly should be taken offline until they can be. For most small businesses losing the website for a few days is inconvenient. Losing it to an attacker - along with any customer data on it - is a lot worse.
What we’ve done
We patched PHP across the environments we manage, including the sites we host for clients and agency partners, and audited our own internal tools for anything running PHP.
For the record, our own website isn’t affected. It’s a static site with no PHP or database behind it, which is one of the reasons we built it that way. That’s not the right answer for every business, but it does mean one less thing to patch at short notice.
The bigger picture: things are speeding up
It’s worth noting that these flaws had been sitting in PHP for over a decade. The organisations credited with finding them used AI as part of their research, and Amazon’s security team noted that AI is making it much cheaper to turn a published fix into a working attack. The first exploitation attempt they saw came four days before the flaws were even made public.
The gap between “a flaw is found” and “someone is using it against you” used to be measured in weeks. It’s now hours, and it’s going to keep shrinking. There’s no realistic way for a small business to win that race on its own.
What you can do is make sure you’re not starting from zero when the next one lands. Know what you have - your website, where it’s hosted, what it runs on - and be clear about who is responsible for keeping each piece updated. That’s the same advice we gave about CCTV and door entry systems earlier this month, and it’s becoming the most useful single thing any business can do.