Marc Köhlbrugge had my favorite take on last week’s critical PHP vulnerabilities:
“If this PHP vulnerability allows remote code execution, doesn’t that mean we can use the vulnerability to auto-patch all vulnerable servers?”
If we didn’t laugh, we’d cry.
While everyone worries that AI vibe coding will flood the internet with insecure code, LLMs are finding insecure code that we made years ago.
The PHP2Shell vulnerabilities reach back to PHP 5.4 and could let unauthenticated attackers take control of your server. The vulnerabilities were old. What’s new is how quickly they can be discovered and turned into working attacks.
We’ve been through situations like this before: Heartbleed in 2014, Log4Shell in 2021 and Zenbleed in 2023.
Mitigating Zenbleed meant updating CPU microcode and rebooting servers. I remember our teams debating whether we had to apply those patches on a weekday or if they could wait until the weekend to minimize business interruptions.
We no longer have the luxury of waiting days to fix new vulnerabilities.
Attackers get to move fast and break things. Defenders have to move fast without breaking anything.
And a patch doesn’t protect your server until someone deploys it.
PHP2Shell is severe, with two 9.2-rated flaws that don’t require a login or a bug in your application. Researchers demonstrated attacks against current WordPress, Drupal and Joomla sites. Even a simple “Hello World” page could be vulnerable.
If you manage your own server, you need to update PHP and follow the PHP team’s latest guidance. Updating WordPress, plugins or themes won’t fix the problem.
But if your site runs on WordPress.com, WordPress VIP, WP Cloud or Pressable, Automattic’s announcement said your site was already protected:
“There is nothing you need to do.”
Businesses aren’t paying for hosting. They’re paying for peace of mind.
Homeowners should check their smoke detectors, but they shouldn’t have to own a fire truck and 60 pounds of protective gear. Likewise, website owners shouldn’t have to monitor security advisories and manage emergency runtime updates.
Managed hosting proved its value last week. When the alarm sounded, the firefighters had already arrived.
