On 21 October, PHP released an urgent security fix. Two flaws, now known as PHP2Shell, can let an attacker run their own code on a web server without logging in. They are rated 9.2 out of 10 for severity, and security researchers have reported them being exploited.
Why this one mattered.
Most WordPress problems live in a plugin or a theme. This one did not. The bug is in PHP itself, the language WordPress runs on. A security plugin or a strong password does not protect you here. The only fix is updating PHP on the server and restarting it.
What we did.
Within a day of the release, I went through every server we run for clients. I updated PHP to the patched version and restarted the PHP workers so the fix actually took effect.
Then I checked every live website one by one. I did not just trust the package version. I tested each site through its own web server and confirmed it is answering with the patched PHP. Every site passed.
Updating is not the same as being patched. We check.
If your site is hosted somewhere else.
Ask your hosting provider two questions. Is the server on PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or newer? And were the PHP workers restarted after the update? If your site runs PHP 8.1 or older, there is no official fix, and it is time to move.
What this means for you.
If NexGU hosts your website, you do not need to do anything. This is part of what we mean by being a partner and not just a vendor. When something like this happens, we handle it before you have to ask.
If you are unsure about your own site, write to me at gokul@nexgu.com or reach us at nexgu.com/connect. I am happy to take a look.
Sources.
- PHP2Shell overview, watchTowr: severity, fixed versions, reported exploitation.
- PHP2Shell FAQ, Tenable: affected branches and the lack of a fix for older PHP.
