What do the PHP cyber attacks mean for your website?

Luke Meredith

Websites around the world have been taken offline while organisations address serious security flaws in the PHP programming language. For business owners, the headlines raise an understandable question. Could the same issue affect their own website?

Cyber attackers are actively exploiting the vulnerabilities, which makes checking whether the necessary updates have been applied a priority for anyone responsible for a website.

PHP is part of the software that runs websites on their hosting server, including those built using WordPress and Drupal. It supports the systems that millions of websites worldwide depend on, so a problem at this level can require action from the hosting provider.

The PHP Foundation has confirmed two critical vulnerabilities which, under certain conditions, allow attackers to run code on a server without logging in. Both involve the way PHP handles memory and errors. This means the issue goes deeper than something that can be resolved by changing a website password.

Security updates were released on 21 October, with fixes available for several supported PHP versions. Therefore, a website doesn’t necessarily need to move to the newest major version of PHP, but its hosting environment does need the appropriate security patch.

A website can appear to be working normally while the software behind it still needs attention, so being able to load the homepage isn’t enough to confirm that everything is up to date.

At Engage Web, we upgraded our hosting server with the latest PHP security updates on 21 October. This means the vast majority of websites we host are already up to date and protected against these newly identified vulnerabilities.

Some websites may not be compatible with the latest PHP versions because of older functionality, plugins or other technical requirements. Where this is the case, we’ll contact affected clients individually to explain what needs to be done to bring their websites up to date.

For most of our hosting clients, there’s nothing you need to do. If your website requires further attention, we’ll be in touch directly. If you don’t hear from us, you can assume your website has received the necessary security updates. If you would like confirmation, contact our team and we’ll check it for you.

If your website is hosted elsewhere, we recommend contacting your hosting provider to confirm that the necessary PHP security updates have been applied.

About
Latest Posts

Luke Meredith

Content Editor at Engage Web

At home in both the digital sector and the world of communications, Luke thrives on deadlines and has held roles in healthcare, retail and digital marketing, gaining a sound knowledge of a wide range of sectors. He’s a massive swot as well, holding a first-class degree in BA Communication and Media, and now uses his writing skills and keen editorial eye in his role as Content Editor here. Luke helps to oversee our clients’ content requirements, while also looking after a pool of freelance writers across three continents.

ENGAGEWEB