Seven in ten websites are waiting on a patch
Two critical flaws in PHP, the language behind most of the web, leaked before they could be fixed. Most families won't have to patch anything. The people they trust with their data will.
On Tuesday, a post appeared on Hacker News naming two security flaws in PHP that weren't meant to be public yet. It was deleted within hours, but screenshots spread. Within hours, watchTowr, a security research firm, said it had reproduced one of them, and PHP's own security team published an emergency notice: two critical vulnerabilities, a fix coming on Wednesday, and a request that everyone running PHP get ready to upgrade.
Researchers have nicknamed the pair php2shell. The name says what's feared: send the right request to a website, and you get a shell on the server behind it, which means control of the machine and everything on it. PHP hasn't published the technical details yet, and won't until the fix is out.
- Severity
- Critical 9.2 out of 10, as rated by PHP
- Fix
- Due 1:00 am Thursday 22 October, Sydney time
- Affected
- Not yet confirmed by PHP. Researchers believe every version since PHP 5
- Old versions
- Reports say only PHP 8 will get a fix. Unconfirmed
- Attacks seen
- None reported as of Wednesday, by watchTowr or Huntress
Why this one is big
PHP is the language underneath WordPress, Drupal, Magento and a long tail of booking systems, client portals and school websites. W3Techs, which tracks the technology behind websites, puts it at about 70% of the sites whose server-side language it can detect.
The harder number is how many of those are old. More than a third of PHP websites still run version 7 or 5, which PHP stopped supporting years ago. If reports are right that only PHP 8 gets a fix, those sites will have no patch to install. Their owners will have to upgrade, which is real work, or put the site behind protection and hope.
You can patch your own phone. You can't patch the thirty servers your family's data lives on.
It isn't your server. It's everyone else's.
Almost no family runs PHP at home. But think about where your details actually sit: the school's parent portal, the real estate agent's website, the family office's WordPress site, the accountant's client login, the booking system at the clinic. Some of those run PHP, and some run it on versions nobody has touched in years.
None of them are yours to fix. Each is someone else's job, on someone else's timeline, and you'll usually only hear about it if something goes wrong. That's the gap we wrote about in our essay: the companies you've given access to are another way in.
What to do this week
- Ask whoever runs a website for you. The family office, a business, a foundation, a personal site. Ask in writing: do you use PHP, which version, and when will you install Thursday's fix?
- If the answer is PHP 7 or older, ask for a plan. Upgrade, take it offline, or put it behind a firewall. "We'll look into it" isn't a plan.
- Expect emails that ride the news. "Urgent security update, log in to confirm" is the oldest trick there is. Don't click. Go to the site yourself.
- Watch for breach notices over the next few weeks. If a company tells you it was affected, change that password. If every password is different, one breach stays one breach.
Or have someone do it. Knowing which of your vendors run what, and calling them before the exploits land, is exactly what private cybersecurity is for.
Sources
The leak, PHP's notice, the 9.2 rating and watchTowr's reproduction.
bleepingcomputer.com
PHP's own notice: two critical flaws, a fix on 21 October at 14:00 UTC, details to follow.
php.net
No attacks seen yet, and what server owners should do before and after the fix.
huntress.com
The researchers who confirmed the flaws: what's known, what isn't, and what to prepare.
watchtowr.com
About 70% of websites with a known server-side language, and the split by version.
w3techs.com