Today, security researchers at Wiz published details of a serious set of flaws in PHP, the programming language behind around 70% of the websites on the internet. They've named it PHP2Shell.
If your website or business application runs on PHP, it's very likely affected and needs updating. Here's what's happened, how worried you should be and what to do about it, with no technical background needed.
If you'd rather someone just checked for you, we'll review your site for free and tell you where it stands.
At a Glance
- Severity score, near the top of the scale
- 9.2 / 10
- An attacker only needs to reach your site
- No login
- Every PHP version since 5.4 is affected
- 10+ years
A fix is available. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released today to close the holes.
What's Actually Happened?
PHP is the engine underneath WordPress, Drupal, Joomla, Laravel and countless custom business applications. A problem in PHP itself isn't one website with a bug. It's a crack in the foundation that millions of websites are built on.
The researchers found that a carefully crafted request can trick PHP into running an attacker's own instructions on the server. They showed it working against fresh, standard installs of WordPress, Drupal and Joomla.
Think of it as a fault in a popular brand of lock. It doesn't matter how well your front door is built: if the lock has a flaw, anyone who knows the trick can open it.
Why Is This So Serious?
An attacker doesn't need a login, only the ability to reach your site, and so does everyone else on the internet. If they get in, they can control the server your site runs on, not just one page. That means they could:
Read customer data
Names, emails, orders and anything else your site stores.
Infect your visitors
Plant malware that targets the people using your site.
Send spam as you
Use your server to send email, damaging your reputation.
Reach other systems
Use your server as a stepping stone into the rest of your business.
Why now matters: at the time of writing there are no public reports of attackers using this. But the details are now public, and attackers usually start scanning the internet for unpatched sites within days, not months.
Is My Website Affected?
If it runs on PHP, almost certainly. Every PHP version released in the last ten years is affected, and it doesn't matter how well the site itself was built. If your site uses any of these, it runs on PHP:
- WordPress
- WooCommerce
- Drupal
- Joomla
- Magento
- Laravel
Still not sure? Whoever built or hosts your site can tell you in a minute.
Why "Just Update It" Isn't Always Simple
The fix only exists for recent versions of PHP. Where you stand depends on which version your site uses.
PHP 8.2 or newer
An official fix is available. Updating to the latest release of your version should be quick and routine for a site that's been kept up to date.
PHP 8.1 or older
No official fix is coming. The only lasting answer is moving the site to a supported version, and older sites often need some work before they'll run properly on one.
How we upgrade older sitesNot sure which side you're on?
We'll check your site's PHP version for free and tell you whether it needs a quick update or an upgrade. You don't need to know anything technical to ask.
What to Do Now
Find out what your site runs on
Ask your developer, agency or hosting company which version of PHP your website or application uses. No one to ask? We'll check it for you.
Ask whether the fix has been applied
On PHP 8.2 or newer, the update should go on as soon as possible. Some hosting companies do this for you, so confirm it rather than assume it.
If you're on an older version, plan the upgrade now
On PHP 8.1 or older, moving to a supported version is the only lasting answer. Get it scheduled rather than waiting to see what happens. See how we handle legacy upgrades.
If nobody's looking after your site, fix that too
If there's no clear answer to who would apply this update, that's the bigger gap. This won't be the last security fix your site needs. Our ongoing support covers this.
Tip: When you ask, don't settle for "we'll look into it". The useful answer is "it's been updated" or "it's booked in for this date".
Final Thoughts
Flaws like this aren't anyone's fault, and they aren't rare. What makes the difference is whether someone is keeping an eye on your site and can apply the fix when one comes along.
If you're not sure who looks after your site, or you know it's on an older version of PHP, get in touch. We'll review it for free and give you a straight answer on what it needs. Our ongoing support keeps sites patched as a matter of course, and our legacy application upgrades service is there for sites that have fallen too far behind to simply update.
Not sure if you're affected?Let’s take a look.
Tell us your website’s address and who hosts it. We’ll check which version of PHP it runs on and tell you what it needs to be safe from PHP2Shell.
Don’t know what your site runs on? That’s fine, finding out is our job.
Request a Free ReviewFree, no-obligation conversation to start.
Whatever state your site is in, we can help.
- Check which PHP version you’re running
- Apply the security fix on PHP 8.2 or newer
- Upgrade older sites to a supported version
- Keep it patched with ongoing support
Any further work is agreed with you before it starts.