EN
EnglishΕλληνικάRomână
Book a free call
All articles

The PHP flaw fixed this week: what to check on your website

On 21 October PHP released an urgent fix for two serious security flaws. If your site runs on WordPress, WooCommerce, PrestaShop or OpenCart, here is what to check and what to ask your host.

The PHP flaw fixed this week: what to check on your website

On 21 October the team that makes PHP released an urgent fix for two serious security flaws. If your website runs on WordPress, WooCommerce, PrestaShop or OpenCart, it runs on PHP, and this concerns you.

You do not need to understand the flaw to deal with it. You need to know three things: whether your site uses PHP, who updates it, and whether they have done it yet. This post goes through each one in plain words.

What happened

PHP is the programming language behind a large part of the web. W3Techs, which tracks what websites are built with, finds it on 69.3% of the sites whose language it can detect.

Researchers at the security company Wiz found the flaws in August and reported them to the PHP team. They call the problem PHP2Shell. According to Wiz, every PHP version released in the last ten years has at least one of the two flaws. They showed it working against ordinary WordPress, Drupal and Joomla installs.

Both flaws let an attacker run their own code on the server, with no password and no login. The PHP team gave a day’s notice on 20 October. The fixed versions came out on 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The attacks started fast. On release day Patchstack, a company that tracks WordPress security, reported attackers already probing sites. CERT-EU, the security team for the EU institutions, noted that working attack code had begun to circulate.

Attacks like these are run by scripts that try every site they can reach. A small shop’s site gets tried as often as a big one.

Updating your plugins does not cover this one

Most website security news is about one plugin or one theme. You press update inside WordPress and move on.

This flaw sits in PHP itself, the software on the server that runs WordPress and everything else on it. A site whose plugins are all updated is still exposed. The fix goes on the server, and it is made by whoever controls that server.

You may also see “fix” plugins and pasted bits of code offered in the next few days. Patchstack advises against them, and CERT-EU is plain about it: only an update fully fixes these flaws.

How to tell if your site runs on PHP

A few quick checks:

  • The site was built with WordPress, WooCommerce, Joomla, Drupal, PrestaShop, OpenCart or Magento. All of them run on PHP.
  • You log in to edit it at an address ending in /wp-admin or /wp-login.php. That is WordPress.
  • Some page addresses on your site end in .php.
  • Your hosting control panel (cPanel, Plesk or DirectAdmin) has a setting called PHP version.

If your site is on Shopify, Wix or Squarespace, the company behind it runs the servers, and there is nothing for you to update.

If you are still not sure, ask whoever built the site. They will know the answer without looking it up.

Who updates PHP on your site

That depends on the kind of hosting you pay for.

On shared hosting, the usual low-cost plan where many sites live on one server, the hosting company updates PHP for you. Some moved before the release. SiteGround, for example, says it switched off the affected features on its servers ahead of the fix, and that its customers need to do nothing. Check your host’s news page, or send them a message.

On a server of your own, such as a VPS a developer set up for you, nothing gets updated unless someone does it on purpose. If that is you, this is the one to chase today.

Older versions need a separate word. PHP 8.1 and anything before it no longer get fixes from the PHP team at all. Some hosts and Linux vendors patch old versions themselves, so ask yours directly. PHP 8.2 stops getting fixes on 31 December 2026, which means a site on 8.2 needs an upgrade plan soon.

The message to send today

Copy these three questions into an email to your host or your web person:

  1. Which PHP version does our site run on right now?
  2. Has it been updated for the PHP security release of 21 October, and on what date?
  3. If we are on 8.1 or older, when can we move to a version that still gets fixes?

If the site went a few days without the update, ask them to check for signs of a break-in as well. Patchstack lists what to look for, such as a run of unexplained memory errors, and advises changing the server’s passwords if anything turns up. Changing your own site login passwords afterwards costs you five minutes.

A note on our own sites

The sites we build at 450labs do not run on PHP, so this week’s fix did not touch them. Hosting, monitoring and fixes are part of our monthly fee, so when the next update lands somewhere else, it is ours to handle. If you would like someone to look at what your current site runs on, you can book a short call.

Sources