The Internet Was Not On Fire This Week. Here’s What Actually Happened With PHP2Shell.
If you read any tech news this week you’ll have seen the headlines. Critical. Emergency. Seventy per cent of the internet. One security firm proudly quoted a post from a dark web forum saying the internet was “going to be on fire”, which is a bit like quoting a bloke in the pub to forecast the weather.
Here’s the thing. The vulnerability was real and it was serious. I’m not going to pretend otherwise. But I run the servers that host our clients’ websites, and I spent Wednesday and Thursday dealing with it, and at no point was anything on fire. So I want to walk through what actually happened, because I think the way this got reported did more harm than good.
The boring version
PHP is the language WordPress runs on. On Tuesday 20 October, details of two bugs in PHP leaked a day early. Both could, in the worst case, let an attacker run their own code on a server. On Wednesday the PHP team released fixes: versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If you’re on one of those, you’re fine. If you’re on anything older than 8.2, there is no fix and you need to upgrade.
That’s it. That’s the whole story. Patch available within a day of the leak. Update your server. Move on.
The version you were sold
What you got instead was a nickname, a CVSS score of 9.2 repeated like a tabloid number, and a lot of copy about remote code execution and the end of days. One widely shared piece said the flaws were “being exploited”. Another, published the same day by a company that actually sells PHP security patches, said plainly that no exploitation had been reported and no public exploit code existed. Those two things can’t both be true, and only one of them had a reason to be cautious.
I understand why it happens. Security companies need you frightened, because frightened people buy scanning tools. Tech sites need clicks, and “update your PHP” doesn’t get clicks. So every vulnerability becomes the big one, and the actual information, the bit a business owner could act on, ends up buried under paragraph six.
The cost of that isn’t abstract. I had clients messaging me on Wednesday morning asking if their site had been hacked. Not “is there anything we need to do”, but “has it already happened”. That’s not awareness. That’s a news cycle that has trained people to panic first and ask questions later, and it’s the same news cycle that will go quiet the next time something boring but important needs doing, like renewing an SSL certificate or getting off PHP 7.4.
What we actually did
Because I’d rather show you than tell you.
Wednesday, same day the fix was released: both of our servers were updated to the patched PHP versions. PHP and the web server were restarted straight away rather than waiting for a scheduled reboot, because a patch that’s installed but not running isn’t a patch.
Thursday: every site we host was checked individually through our monitoring. Not “the server says it’s updated so they must be”, but each one reporting back its own PHP version. All patched.
While I was in there, I removed an old PHP 7.4 install that was sitting unused on one server. No live site needed it, there’s no fix for it, so it went. I ran a full malware scan on both servers to check nothing had crept in during the gap between the leak and the fix. Nothing had.
None of that is heroic. It’s maintenance. It’s what you’re paying for when you pay a monthly hosting and management fee, and it’s exactly the kind of thing nobody writes a headline about because “man updates server, nothing happens” isn’t a story.
If we don’t host your site
Check your PHP version. Log in to your hosting control panel, find it, and if it’s below 8.2, email your host and ask when they’re upgrading. If they can’t give you a straight answer, that is your answer.
While you’re there, make sure your backups are stored somewhere other than the server they’re backing up, and that every admin login has two-factor authentication. Those two things will protect you from far more than this week’s headline ever will.
The bit I actually care about
Good security is dull. It’s keeping things up to date, having a plan, and not leaving old software lying about. The industry has every incentive to make it sound dramatic, because drama sells, and the result is that the people who most need to do the dull stuff are either paralysed by fear or so numb to the warnings they’ve stopped listening.
So here’s my advice. The next time you see a headline telling you the internet is on fire, ask two questions. Is there a fix? And has the person I pay to look after my website applied it? If the answers are yes and yes, close the tab and get on with your day.
If you don’t know who that person is, or you’re not sure they were watching this week, get in touch. That’s the conversation worth having.
