Craft CMS and PHP2Shell - how we dealt with it

On 21st October we became aware of an vulnerability in PHP, dubbed PHP2Shell.

PHP is a server-side programming language that powers about 70% of the web, including all WordPress, Craft CMS, Drupal, TYPO-3, Laravel and other popular CMS’ and frameworks.

We took immediate action on three fronts:

• For our clients who use Craft Cloud, we spoke to the Craft team to understand the mitigations they’re putting in place and notified affected clients, also informing them that there’s a route to take the sites offline if they wish.
• For our clients that use Servd, we spoke to them to learn the procedures and out of an abundance of caution we put all sites and environments on Servd’s maintenance mode which stops access to PHP entirely.
• For our clients that use a VPS, we added a firewall rule so that only the VPS providers and Mutual can access the servers, effectively turning off the site for public access.

Taking sites offline is never a nice route to take but this vulnerability is particularly potent, and a short period of downtime while mitigations and patches land is far better than a long outage and clean-up after an attack. It also matched the UK Government’s official advice, as well as guidance from security agencies and experts around the world.

At around 15:00 (UK time) the patched PHP release went live. As each hosting vendor tested and released their own patches, we carried out any manual steps they asked for and brought sites back online. All supported sites were patched and back online by about 20:55.

Huge thanks to the Craft CMS, Craft Cloud, Servd, Cloudflare and PHP teams, and to my colleagues at Mutual, who handled a stressful day superbly and pulled together to help keep our clients and the web at large safe.

Stay safe.