What October's PHP security incident means for your website

What happened

PHP is the programming language behind most of the websites on the internet. Most popularly, WordPress runs on it, and so does Craft CMS, which we use for a lot of our clients' sites.

On October 20, word got out that PHP was about to announce two serious security flaws. Details leaked before the official announcement, and so did screenshots of a tool built to exploit them. The flaws let an attacker run their own code on a web server just by sending a specially built form submission. That's about as bad as it gets for a website. They were rated 9.2 out of 10 for severity.

PHP released the official fix on the morning of October 21. By then attacks had already started. The NSA suggested that unpatched (read: out of date) servers turn off immediately until they can be fixed, and within a few days the FBI and other agencies were telling organizations to update right away or turn off.

What we did

We heard about the rumblings about 24 hours before and treated it as an emergency. Overnight we put temporary safeguards on every server we manage. The main one blocked the kind of form submission the attack relied on. When PHP released the fix the next morning, we installed it as fast as we could and then checked every site to make sure it still worked.

Sites on a supported version of PHP were the easy case. The fix went on and that was it.

Older sites were harder. PHP stops releasing fixes for a version a few years after it comes out, and the same is true for older versions of Craft and WordPress. So for those sites the choices were an upgrade, a simpler static version of the site, or a move to a server where it could be protected.

If your site was patched, there's nothing you need to do. If we need anything from you, we already reached out directly.

Today, all of our clients are safe, either with updated servers or with mitigation blocks in place.

Flaws like this are coming faster

Serious security flaws aren't new. Software has always had them, and they often sit unnoticed in code for years. What's changing is how fast they're being found.

AI tools have gotten very good at reading code and spotting mistakes. This PHP flaw is an example. The security firms that reported it said they found it with the help of AI models, including one from OpenAI. In April, Anthropic said its newest model had found thousands of serious flaws in widely used software, some of which had gone unnoticed for decades. Anthropic hasn't released that model to the public. It's working with the companies that make the software to get those flaws fixed first.

That's the good side. But the same kind of tools are available to attackers. Open-source AI models that anyone can download keep getting better, and nobody controls how they're used. So we expect more flaws to be found, more fixes to ship, and less time between a flaw going public and someone trying to use it. In October that gap was hours.

Waiting a month to install an update used to be considered safe for non-enterprise systems. It isn't anymore. AI tools make large scale bot attacks even more dangerous with these new exploits.

How we're responding

We won't get into the details of any one site here. But in general terms, this is the plan.

We're moving every client we can onto a fully supported setup that stays updated. That means current versions of PHP, of Craft or WordPress, and of the server underneath. When everything is current, a fix like October's is something we can install in minutes the moment it comes out. That keeps the time a site is exposed very short.

For a variety of reasons, some sites can't be fully upgraded right away. We're moving those sites into a walled-off environment. They sit behind a protective layer that screens traffic before it reaches the site, and they're kept apart from everything else so a problem with one can't spread. It's not as good as being current, but it protects the site while we plan the upgrade together.

And we're watching. We follow the security announcements for the software we use, and we'll keep adjusting as this develops.

Our commitment

Keeping your site safe is part of the job, and we take it seriously. We would much rather over-prepare than explain an attack after the fact.

If you have questions about your site, or want to talk about getting it onto a current setup, email us at help@leaplogic.com. We're glad to walk through it with you.