What’s Happened?
PHP has released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities¹. Both could allow an attacker to run commands on a web server without needing to log in¹². The UK’s National Cyber Security Centre (NCSC) says all versions of PHP are affected and is urging UK organisations to act².Why PHP Matters to YOU
PHP is a programming language that runs behind a huge number of websites and web applications, including anything built on WordPress². If your site runs on it, this applies to you.What Updating Matters
PHP’s own advice is that updating is the only complete fix. Temporary measures can reduce exposure, but they don’t make a site safe¹. There’s a fix and a clear process, but it needs to be applied.What we’re doing
- Identifying which of our client sites and applications run on PHP
- Applying the fixed versions to the systems we manage, and checking them afterwards
- Updates to the systems we host and manage are complete
What You May Want to Do
If we host or maintain your website or app: nothing, for now. We’ll be in touch if anything needs your input.
If your site is hosted elsewhere: ask your hosting provider whether they’ve applied the update, and keep your website platform, themes and plugins up to date. Some third-party products also bundle PHP, so it’s worth checking for their updates too².
If you have a bespoke app or web application: confirm where it’s hosted and who is responsible for updating it. If you’re unsure, ask us.
The NCSC’s wider advice is to identify which systems run PHP, prioritise anything internet-facing, apply updates as they become available, and, where an immediate fix isn’t possible, consider taking the system offline until it’s fully protected².
If Your Site Runs On An Older Version of PHP
PHP 8.1 and earlier no longer receive updates from the PHP project. Some hosting providers and distributions supply their own fixes, but otherwise the answer is to upgrade to a supported version. PHP 8.2 reaches end of life on 31 December 2026, so it’s worth planning ahead¹.If An Update Can’t Be Applied Quickly
The NCSC advises considering taking the system offline until it can be fully protected, and checking for signs of compromise if it has to stay live in the meantime². If that’s your situation, call us.Need a Hand?
If you’re not sure whether this affects you, or you’d like us to take a look at your website or app, get in touch on 01902 595 420 or via our contact page. No question is too small.
