If you run a small business website, last week probably passed you by without a second thought. Behind the scenes, though, it was one of the busiest weeks the web has had for a long time, and it’s worth five minutes of your attention.
On Wednesday 21 October, the people who look after PHP released an emergency fix for two critical security flaws, which have been nicknamed “PHP2Shell”. Within hours, attackers were trying them out on websites all over the world. Here in the UK, the tech minister told the House of Lords that 32 government services were unavailable and four partly unavailable. That was largely because they had been taken offline as a precaution while they were patched.
I don’t want to frighten anyone. But this one affects a lot of ordinary small business websites, so here’s what you need to know in plain English.
PHP is a programming language that runs on the server (the computer where your website lives) and builds your web pages each time someone visits. You’ve probably never heard of it, and that’s fine. What matters is that it powers WordPress, Joomla, Drupal and Magento, along with lots of shared hosting and control panels. The Register puts it at around 70 per cent of websites where the server-side language is known. So if your website is built on WordPress, it runs on PHP. Most small business websites do.
What actually happened?
The two flaws are bugs in how PHP handles memory. In plain terms, they could let someone on the other side of the world run their own code on your web server without needing a username or password. The official PHP announcement says they can allow “unauthenticated remote code execution” and affect “all PHP installations serving web requests”.
What made this one unusual was the speed. According to The Register, Amazon spotted an attempt to exploit it on 17 October, four days before the fix was released. Cloudflare said attempts jumped to tens of thousands within 45 minutes of the announcement, and they have since climbed into the millions. The UK’s National Cyber Security Centre sent 50,000 warnings to businesses and other organisations, telling them to patch immediately or consider taking affected systems offline.
The good news is that, as of 23 October, the PHP Foundation said it had no evidence of the flaws being exploited on patched versions of PHP. Patching works. The question is whether yours has been patched.
A third, related bug was announced on 23 October. The PHP team says it needs “a very unlikely combination” of settings and code, so it isn’t getting an emergency fix. There is a simple setting hosts can switch off in the meantime.
As if that wasn’t enough, the same week brought separate trouble for UpdraftPlus, a very popular WordPress backup plugin. (A plugin is an add-on that gives WordPress extra features.) Search Engine Journal reports that the company behind it had its website compromised over the weekend of 17 and 18 October. Attackers then used stolen connection keys to install malicious plugins and create hidden administrator accounts on some connected sites.
This only affected sites connected to the UpdraftCentral Cloud remote management service, not every site with the plugin. However, remote management was selected by default when people connected their account. That means plenty of owners who only use the plugin for backups may have been connected without realising. Fixed versions (1.26.13 for the free plugin and 2.26.13 for premium) came out on 19 October. Importantly, updating doesn’t remove anything nasty that was already added.
“Who is responsible for updating my website?”
This is the question I’d most like you to take away: who actually keeps your website up to date? PHP is usually looked after by your hosting company, particularly on shared hosting. WordPress, its plugins and its theme are usually looked after by whoever manages your site. That might be you, your web designer, or nobody at all. That last answer is more common than you’d think. A site gets built and launched, then quietly left alone for years. If you don’t know the answer, now’s a very good time to find out!
What to do now
Contact your hosting company, or your web designer if they handle hosting for you, and ask a simple question: “Has the PHP security update from 21 October been applied to my website?” The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site is on PHP 8.1 or older, the PHP project no longer supports it, and that’s a conversation worth having anyway. PHP 8.2 itself reaches end of life on 31 December 2026, so it’s worth planning ahead for that too.
If you use WordPress, log in and have a look around. Check the Plugins page for anything you don’t recognise, check the Users page for administrators you didn’t create, and make sure everything is up to date. If you use UpdraftPlus, check you’re on the fixed version and remove any UpdraftCentral connection keys (under Settings, UpdraftPlus, Advanced Tools, UpdraftCentral). Then change your administrator passwords.
Finally, check your backups. Do you have them, where are they kept, and has anyone ever tested restoring one? A backup you’ve never tested is more of a hope than a plan.
What if my site has to go offline?
Some sites were taken offline last week while they were patched, which was sensible. If yours ever needs to be, it’s worth knowing what Google thinks. Google’s John Mueller advised that sites taken down for updates should show a “503” response rather than simply timing out or showing an error. A 503 is a code that tells Google “closed for maintenance, back shortly”. Google says it keeps your existing pages in its search results while you work. Don’t leave it like that for too long, though. Google’s guidance is not to keep it up for more than a day or two, because pages may start dropping out of its index. Your web designer or host will know how to set it up.
Need a hand?
Websites need a little looking after, in the same way a van needs a service. Most of the time nothing dramatic happens, which is exactly the point. If you’re not sure whether your website has been updated, or you’d just like someone to keep an eye on it for you, get in touch. I’m always happy to have a quick look and tell you plainly where you stand.
