What’s Happened?
On 20th October, PHP’s maintainers gave advance notice of a security release addressing two critical vulnerabilities, both rated 9.2 out of 10 on the CVSS v4.0 severity scale¹. The release is scheduled for 3pm BST today, though they’ve said it could come sooner¹.
The UK’s National Cyber Security Centre (NCSC) has since encouraged UK organisations to prepare for immediate updating of systems using PHP².
Why PHP Matters to YOU
PHP is a programming language that runs behind a huge number of websites and web applications, generating pages and handling the logic behind the scenes². If your site is built on WordPress, for example, it runs on PHP. Many bespoke web apps do too.
What We Know, and What We Don’t Yet
The advance notice is deliberately light on detail. The fixed versions and full details of both vulnerabilities will be published with the release¹. Until then, nobody can say exactly which versions are affected, which is why the NCSC’s advice covers any version of PHP².
The upside of advance notice is time to prepare before a fix lands.
What we’re doing
- Tracking the release, so we can act as soon as it’s published
- Identifying which of our client sites and applications run on PHP
- Applying the update to the systems we manage as soon as it’s available, and checking them afterwards
What You May Want to Do
If we host or maintain your website or app: nothing, for now. We’ll be in touch if anything needs your input.
If your site is hosted elsewhere: ask your hosting provider when they’ll be applying the update, and make sure your website platform, themes and plugins are up to date. The NCSC also advises watching for updates from any third-party software vendors, as some products bundle PHP².
If you have a bespoke app or web application: it’s worth confirming where it’s hosted and who is responsible for updating it. If you’re unsure, ask us.
The NCSC’s wider advice is to identify which systems run PHP, prioritise anything internet-facing, apply updates as they become available, and, where an immediate fix isn’t possible, consider taking the system offline until it’s fully protected².
Need a Hand?
If you’re not sure whether this affects you, or you’d like us to take a look at your website or app, get in touch on 01902 595 420 or via our contact page. No question is too small.
