An update on PHP and security

Hi there,

Last week you would have heard from us directly and in the news about PHP2Shell. Two vulnerabilities in PHP that are considered critical severity because of the potential risk they present.

We blogged about it here:

But I also wanted to write to you with some quick-fire Q&As to help you understand what it was and what it means.

What is PHP?
PHP is the server side programming language that powers much of the web (estimates are at least 70%, probably way more), including all of our websites.

What was PHP2Shell?
These were two vulnerabilities that frontier AI models and security researchers discovered. They opened a door for people to potentially run their own code on the server.

Was my site affected?
Every single site running PHP had this vulnerability, including the UK Government, BBC, and the White House.

What did you do?
On the morning of 21st October we put most of our sites on maintenance mode by 8AM, except for where the hosting company for that site had already put in appropriate mitigations.

We worked with our hosting providers and have confirmed that none of our supported sites had signs of abuse.

When the patch was released at around 3PM we systematically updated and redeployed each website, bringing them back online as they were patched.

What do I need to do?
If you're supported by Mutual, nothing. Everything is patched, and we continue to run updates each month to keep your site secure.

If you're not supported by us, you should ensure your PHP is patched and your CMS is up to date.

Should I not be using PHP?
PHP has been quietly powering most of the web for decades before the average person heard about it last week. It's a solid tool trusted by the largest of websites.

AI is simply able to find bugs humans couldn't, and exploit ones that were previously too inconvinent for humans to exploit.

This works in both ways, AI is making software more secure too by putting those same tools in the hands of the good guys.

We wrote a similar analysis about the increase in Craft CMS vulnerabilities recently:

Over the next few years we're going to continue to see an increase of serious cyber security issues across all technologies and the takeaway is not to move technology but to stay vigilent and on supported platforms.

Any questions?
If you have any questions, I'm happy to answer them so please just fire them over andrew.fairlie@mutual.agency.

Cheers,
Andrew & Team Mutual