Two critical PHP flaws: what your business needs to check this week
You may have seen websites going offline this week, including government services, a council and parts of Wikipedia. The cause is a pair of serious security flaws in PHP, a programming language that runs a large share of the web.
What’s happened
Researchers at the security firms Wiz and Calif found the flaws using advanced AI. According to the reports, they had gone unnoticed for more than a decade. A fix has been released, and cyber-security agencies in the UK, EU, US, Japan and Australia have all urged organisations to apply it quickly. Where that isn’t possible straight away, the UK’s National Cyber Security Centre says to consider taking the affected system offline until it is fixed.
The risk is that an attacker could run their own code on a vulnerable server without logging in. That could mean installing malware, reaching your data or taking your site down. Cloudflare has reported early attacks already emerging. Wiz estimates that roughly 70% of the internet is affected, though that figure hasn’t been independently verified.
Why this matters even if you’ve never heard of PHP
PHP sits quietly underneath a lot of everyday business software. WordPress, Drupal, Joomla and Magento sites all run on it, as do many shared hosting platforms and control panels. It can also be bundled inside third-party products without anyone realising. As one security expert put it, the hard part isn’t installing the patch. It’s finding everywhere PHP is running.
What to do now
Make a list. Identify every website, web app, plug-in and third-party tool you use that might run on PHP. Include old microsites and anything a former supplier built for you.
Ask your suppliers. Contact your web host, agency and software vendors. Ask whether they’ve applied the fix and when.
Update, and check your version. The fix has only been issued for the latest PHP versions. If you’re on PHP 8.1 or older, you’ll need to upgrade, not just patch.
Don’t leave an unpatched site exposed. If you can’t fix something quickly, take it offline until you can. A temporary outage is better than a breach.
Look for signs of compromise. Check logs for unusual activity, and keep monitoring for further security updates, including for any products that bundle PHP.
The bigger lesson
This is a good example of the hidden risk in the tools and workarounds growing businesses accumulate over the years. Nobody chose to depend on PHP, yet many businesses do. And as AI gets better at finding weaknesses, flaws like these will be found, and exploited, faster than before.
If you aren’t sure what’s running behind your website or systems, or you’d like help auditing, patching or upgrading them, we’re happy to talk it through. Get in touch at hello@screenengineering.com or call 01756 860870.
