The 21 October PHP vulnerability: what happened and how we’re protecting your website

On 21 October, a serious security vulnerability in PHP was disclosed worldwide. The good news first: every website managed by comma is secure and running normally again. In this post, we explain what happened, how we responded and how we’ll keep your website even better protected from now on.

What is PHP, and why did this affect so many websites?

PHP is the technology behind a large share of the web, from WordPress and Drupal to online shops and customer portals. It’s what lets your site build pages, process forms and talk to its database.

Because so many sites run on PHP, a single flaw in it exposes millions of websites at once. As soon as a vulnerability like this goes public, attackers start actively hunting for sites to exploit. That makes speed critical.

What we did, in four steps

1. Alert: the vulnerability was disclosed before an official fix existed, so every PHP-based website was potentially at risk.
2. Precaution: we immediately took our PHP-based websites offline for a while. A site that’s offline can’t be exploited, and a few hours of downtime beats a hacked website.
3. Fix: as soon as the security patch was released, we installed it on every site.
4. Check: we thoroughly reviewed each site before putting it back online. We found no signs of compromise.

If your website wasn’t affected, there’s nothing you need to do. If your site needs extra work, we’ll email you separately.

Why updates are your best insurance

A website is never really finished. Every month brings new updates for PHP, for your CMS and for the modules your site relies on. Often they close a vulnerability that has already been made public.

Put updates off and you build up a backlog. The bigger the jump later on, the more work it takes and the greater the risk that something breaks. Small, regular updates are both safer and more cost-effective.

How we’ll handle it from now on

Vulnerabilities in widely used software are turning up more and more often. That’s why we’re making website security a fixed routine, so it’s one less thing for you to worry about.

• Always up to date: we track every update and bundle them into two maintenance rounds a year.
• Tested first, then live: we test every update on a copy of your site, so everything keeps working.
• Quick to respond: when a new vulnerability appears, our action plan is ready and we step in straight away.

• Clear in advance: you’ll get an email beforehand setting out what we have planned.

   

What you can do yourself

A secure website is a team effort. These three habits help:

• Use a strong, unique password for your site’s admin area, and turn on two-factor authentication wherever you can.
• Only give access to people who really need it, and remove old user accounts.
• Notice anything unusual on your site? Let us know right away.