The PHP project is releasing emergency security updates today for two critical flaws. PHP is the programming language behind most websites, including sites built on WordPress. The PHP security team announced the release on October 20. The updates are scheduled for Wednesday, October 21, at 10 a.m. Eastern.
PHP rated each flaw 9.2 out of 10 on the industry's standard severity scale. Researchers at the security firm watchTowr say both are remote code execution bugs. Remote code execution means an attacker could run their own commands on a web server from across the internet. PHP has not published technical details yet. The project says the affected versions and fixed versions will be listed with the release.
The early warning came because details leaked ahead of the planned disclosure date. PHP responded with a public warning that named a firm release date. So far, no attacks using these flaws have been reported. National cyber agencies in Europe and Australia have also told organizations to prepare to patch.
Researchers and those agencies say every PHP version from PHP 5 onward may be affected. PHP itself has not confirmed that range. The project currently provides security fixes only for versions 8.2 through 8.5. Older versions have reached end of life and will not receive this fix. A site still running PHP 7 or older now has a clear reason to upgrade.
Most business owners never touch PHP directly. Your web host or developer handles it for you. Start by asking them two simple questions. Does our website run on PHP? If it does, when will you apply today's update?
Managed WordPress hosting usually updates PHP on the server for you. It is still worth getting a confirmation in writing. While you have your provider on the phone, ask which PHP version your site uses today.
Make sure a fresh, working backup of the site exists before anyone changes it. Moving off an old PHP version can break outdated plugins or themes. A good backup makes that kind of problem easy to undo.
The good news is that this problem arrives with a fix and a date. Businesses that check in with their provider this week will be in good shape.
My I.T. Consultants helps Gun Barrel City and East Texas businesses keep their websites and servers patched and backed up. Call 903-675-5431 or request a Free Assessment. We can help you confirm your PHP version, your update plan and your backups.
PHP logo by Colin Viebrock, CC BY-SA 4.0, via php.net
