The PHP Flaw in the News: Is Your Company Website Safe?

News about a serious PHP flaw keeps coming. Governments have issued alerts, and some public agencies abroad briefly took their sites offline.

If you run a business and don't work with code, the first question is probably simple: is our company website okay?

What happened

PHP is one of the most widely used tools for building websites. Sites built with WordPress also run on PHP.

On October 21, a serious flaw in PHP was made public. It lets someone take over a site from outside without logging in. A security firm found it while checking PHP with AI, and because nobody had noticed it for more than ten years, it drew a lot of attention.

A fixed version came out right away. Older versions, though, are not getting one.

What to check

You don't need to look at the server yourself. Ask whoever built or manages your website two questions.

"Is our site built on PHP?"

If not, this does not affect you.

"If it is, are we on a current version?"

If you are, an update is all you need. Ask them to apply this PHP security update.

If you are on an old version, it's a different story. No fix is coming, so the site needs separate protection.

How we protected sites with no fix available

The day after the flaw went public, MVPIT checked three sites running old PHP: a used book marketplace, an artwork contest community, and a company website. None of them could receive the fixed version.

Switching to a new version on the spot could have taken the sites down. So we locked the doors first and kept watch.

• We closed off the path the attack uses.
• We made sure that even if someone hid a malicious program in the photo upload area, it could not run.
• We set up a daily automatic check for signs of a break-in.
• After that, we used the app, the admin screens, and photo uploads ourselves to confirm the sites still worked.

The company website hardly ever changes, so we turned it into simple pages that leave nothing to attack.

Right after the flaw became public there were signs of someone knocking, but no sign of anyone getting in. It is still too early to relax, so the checks continue every day.

AI was used to gather information, judge where the risk was, review the records, and write the protective settings. People decided whether to apply each change to the sites.

Locking the doors buys time

Locking the doors puts out the immediate fire. The lasting fix is moving the site to a version that is still supported.

The older the site, the harder the move. It's hard to know in advance what will break, and in the end every feature has to be tried again one by one.

Many companies have a site they would like to replace but are afraid to touch. This could be the moment. MVPIT uses AI to find out what will be affected first, moves things over piece by piece without taking the site down, and tries each feature to confirm it works.

If you're not sure whether this affects your site, or you'd like to talk about replacing an old service, reach us through the consultation form on the AI Advisory page.