PHP2Shell: what it means for your website

On 21 October, the people who make PHP released emergency fixes for two serious security flaws, now known as PHP2Shell. If you have a website, there's a good chance it was affected. Here's what it is in plain English, and what to do about it.

What PHP is, and why this one matters

PHP is the software that runs behind the scenes on a huge number of websites. It's what builds each page when someone visits. WordPress, for example, runs on it. By W3Techs' count, 69.2% of websites whose underlying software can be identified use PHP.

The flaws meant someone could run their own commands on the server behind a website, without needing a password or login. That's enough to change the site or read information from it. The researchers who found the problem included teams at Wiz and OpenAI.

The UK's National Cyber Security Centre told organisations to update PHP straight away, and to consider taking systems offline if they couldn't.

Was anyone attacked?

Attacks started quickly. Cloudflare, the web security company, said it was already seeing early attacks before the fixes had even been published.

Why this will keep happening

The flaws had been in PHP for 14 years. They were found now because AI went looking. OpenAI says its models found the problem through a programme it runs to check widely used software, and two security firms, Calif and Wiz, found it with AI tools too, according to iTWire's report.

That changes the maths. Reading through millions of lines of old code for mistakes used to take rare experts a long time, so plenty of bugs sat there unnoticed for years. AI can now do a lot of that reading cheaply. OpenAI's president, Greg Brockman, said: "We expect to find many more such issues over upcoming months."

The same tools work for attackers. Once a flaw is announced, AI makes it much easier to work out how to use it. As one Tufts University researcher put it, "AI makes it far too easy for attackers to find a flaw even when only its existence has been announced." So there will be more of these alerts, and less time between an announcement and the first attacks.

What we did

The fix came out mid-afternoon UK time on 21 October. Within a day, every server we look after had either been updated or had a temporary protection in place while the fuller fix was done.

The questions clients asked us were the obvious ones, and they're worth asking if you're unsure about your own site:

Are we safe? If your server has the fixed version of PHP, the flaw is closed.
Will there be downtime? That depends on how the server is set up, so it's a question for whoever looks after it.
Were we hit? For one client, their security team asked us to check. We went through the website's records and found an attack attempt labelled "php2shell" that arrived after we'd applied the fix. It never got through, and there was no sign anyone had got in. Still, the day after the fix came out, someone was already trying the door, which is why speed matters.

What you should do

You don't need to understand any of the technical detail. You need to know who looks after the server your website runs on, and ask them three things:

Has PHP been updated to a fixed version? They'll know what this means.
If not, when? The answer should be measured in hours, not weeks.
Have you checked for signs that anyone got in before the fix? The NCSC recommends doing this if a system couldn't be updated straight away.

If your website runs on an older version of PHP that no longer gets updates, there's no fix to install, and it needs upgrading. That's worth knowing now rather than at the next emergency.

If you don't know who looks after your server, find out. You'll need to know next time too.

Looking after a website

Websites aren't something you build once and forget. The software underneath them needs looking after, and most of the time that work is invisible. Weeks like this are when it pays for itself.

If you're not sure your website is being looked after properly, we can help.