If you’ve seen headlines this week about a “critical flaw affecting 70% of the internet” and felt your stomach drop slightly, take a breath. Here’s what’s actually going on, in plain English, and four things worth checking today.
What actually happened
Most websites — including an awful lot that small and medium-sized businesses use without ever thinking about it — are built using a programming language called PHP. You’ve probably never heard of it, and you don’t need to. It’s just the engine under the bonnet.
This week, security researchers found two serious flaws in PHP itself. Nicknamed “PHP2Shell“, they could let an attacker take control of a website without needing a password or a login — which is about as bad as it gets. The people who maintain PHP released a fix within hours (full write-up here).
Here’s the slightly unnerving bit: according to Amazon’s security team, someone appears to have been testing this exact attack four days before the fix was even available. So this moved fast, and some attackers may have had a head start.
Should I panic?
No — but you should check, this week, not “at some point.”
The fix exists. The job now is making sure it’s actually been applied to anything you run. The problem is that most business owners genuinely don’t know whether their website runs on PHP, who’s responsible for keeping it updated, or whether anyone’s actually doing it.
Four things to check this week
- Does our website run on PHP, and which version? If you use WordPress, Magento, Drupal, or almost any off-the-shelf website builder, the answer is very likely yes. Ask your web developer or hosting provider directly — don’t assume someone else has already checked.
- Has it been updated to a fixed version? The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your host’s equivalent patched build). If your developer says “we’re on it,” ask for a date, not a reassurance.
- If it can’t be updated immediately, has it been protected another way? Options include a web application firewall (ask if your host uses Cloudflare or similar) or, in the worst case, temporarily taking the system offline until it’s fixed.
- If we’re on an old, unsupported version of PHP, do we have a plan to move off it? Versions 8.1 and earlier are no longer officially supported, which means fixes like this one may never reach them. If that’s you, this is a good prompt to finally deal with it.
The real takeaway
This particular flaw will be fixed and forgotten within a few weeks. The useful habit to take from it isn’t “I patched PHP once” — it’s knowing, before the next one of these turns up, exactly who is responsible for your website’s security updates and how quickly they can act. That one habit will serve you through every future version of this story, whatever it’s called next time.
If this has made you realise you don’t actually know who looks after that for your business, that’s exactly the kind of gap we help people close — have a look at our resilience courses to get started.
