What is happening?
PHP powers around 70% of websites with a known server-side language, including those built on WordPress, Joomla, Drupal and Magento. The UK’s National Cyber Security Centre and CERT-EU have both advised organisations that can’t patch straight away to consider taking affected sites offline.
Dutch government services, including DigiD, are among those that have done so. Cloudflare has also reported early attacks against PHP sites.
What are we doing to protect our clients?
We’re patching every server and checking each site before it returns.
Our engineers are applying the PHP updates across the platform. Before any site comes back online, we’re checking it for signs of tampering.
Sites running PHP 8.1 or older won’t receive a fix from the PHP project. We’ll contact the owners of those sites directly about upgrading.
Your email is unaffected. You can still send and receive through Outlook, Apple Mail or your phone as normal; only webmail is unavailable.
If your website is hosted with us, there’s nothing you need to do, we’ll email you as soon as your site is back online.
What can you do to mitigate the risk to your business?
If you run PHP elsewhere, we recommend acting today, by:
- Asking your hosting provider or IT team when PHP will be updated. WordPress and Joomla automatic updates won’t apply this fix, because it sits at server level.
- Take internet-facing PHP applications offline if you can’t patch straight away.
- Check that you’re running PHP 8.2 or later. Older versions won’t be fixed.
- Restrict your origin server to Cloudflare’s IP ranges if you’re relying on Cloudflare’s WAF rules, which Cloudflare itself describes as a stopgap.
- Review your servers for unexpected PHP files once patched, as attacks were reported before the fix was released.
