This wasn’t a normal security release; it caused widespread disruption across the web, made international news, and escalated very quickly.
By lunchtime, most of our client websites were offline. Something we have never done before. So what was this all about and what does it have to do with AI?
What is PHP and why does it matter?
PHP is a powerful web programming language used across 70% of the World Wide Web. It’s used by Wikipedia, the White House, and many European governments.
Chances are your website runs PHP.
Studio 24 has used PHP as our primary platform for 27 years. We use it to build content-based websites using WordPress and Craft CMS and complex web applications using Laravel and Symfony.
What’s the issue?
Two critical security vulnerabilities were announced, which, if exploited, allow direct access to a server, which means a risk of data being stolen or files (e.g. web pages) being modified. This is known as remote code execution.
How was the issue discovered?
The theoretical vulnerability was known about since 2024 when an external security audit was undertaken for PHP. It was extremely complex and at that time there was no known way to successfully exploit it.
However, now we live in the age of AI, where highly complex security vulnerabilities can be developed at scale.
Earlier this year 3 separate security teams (Calif, Wiz, and OpenAI), working as part of the AI security initiative Patch the Planet, discovered ways to exploit this vulnerability using OpenAI tools. Without AI it’s likely this problem would never have been exposed.
Why did it escalate?
The PHP Foundation, the not-for-profit organisation that runs the PHP project, had planned to release the patches on Thursday 23rd October, but information started leaking online. PHP Foundation took the decision to advance the patch release by 24 hours to mitigate any risks.
Calif, one of the security teams working on the vulnerability, accidentally released a video with information on how to exploit it, which was quickly taken offline.
Around 6 hours before the security patch was released, Chainguard released their PHP patch, breaking normal security procedures and risking attacks before the patch was released officially. This action has been widely criticised in the industry.
By this time, the internet was abuzz with news about this issue; it made international news, and around lunchtime on Wednesday the National Cyber Security Centre (NCSC) advised all organisations running PHP to either update immediately once the patch is available or take their website offline as a mitigation.
Many organisations took extreme evasive measures, taking their websites offline to protect them from any hacking attempts before the security patch was released. We did so for many of our clients.
How was this fixed?
The PHP Foundation released security patches just before 2pm UTC (3pm UK time) on 21st October.
Official releases only existed for current supported versions of PHP (8.2 and above). The PHP Foundation also made source code updates available for older versions.
Open source volunteer Ondřej Surý heroically worked hard to create packages that people could easily install to patch this issue for current and old versions of PHP. His PHP packages significantly sped up the update process for many.
We found Amazon Linux a lot slower; they did not release an update until the early hours of the next day (Thursday), which frustratingly delayed our efforts to bring Amazon Web Services (AWS) hosted clients back online.
The PHP security team closely monitored proof of concepts that appeared after the leak. Likely due to the complexity of the issue, they found no evidence of any functional exploits at the time of the security patch release. This means there was no evidence this vulnerability was being successfully exploited; however, it was still considered a high risk.
What it meant for Studio 24
It was a stressful day, as you can imagine. The right decisions had to be made quickly.
Our priority was for clear and effective communication – between members of the team and between the team and our clients. We realised fairly quickly that this had become a serious issue, but it may have taken some of our clients by surprise when it started being live-reported on the BBC news site.
How we managed the day
It was a real team effort, with everyone bringing their expertise to the table. I managed the technical overview, helped the team audit our websites to plan the updates, supported the devs, provided QA on deployments, monitored news and supplier announcements, and wrote the draft incident report.
Our Head of Delivery, Claire, prioritised which websites to work on first, and co-ordinated client communications. When the severity of the issue was realised, many of our clients escalated the issue to their senior management teams, who were, quite understandably, very worried. Our Project Managers updated and reassured our clients at each new development.
Alan, Gareth and Sean helped with hosting updates. This week we wrote incident reports to help explain this issue to our clients and what can be done in the future.
Grateful and proud of the team
Dealing with this issue meant the team went above and beyond. The team worked late into the night on Wednesday and were back early the next day. Gareth ran out of coffee, which is an emergency in itself!
I’m so proud of the team that they did such amazing work under intense pressure and managed to keep a sense of humour.
Emma, Claire, James and Alice kept our clients fully informed every step of the way. Alan, Gareth, and Sean worked extremely hard to protect our clients’ websites. Thank you all.
Should we still use PHP for websites?
Absolutely! Open Source software is a successful model and, although disruptive, security patches like this make the software stronger.
Arguably, Open Source is more secure than proprietary software, since it has more people contributing fixes and improving it. Bugs are always present in software, but with AI, issues are coming to the surface which never would have been discovered before.
PHP remains a powerful and mature web programming language and we will continue to use it. What happened was extremely rare.
But it does raise the issue of how open source software needs investment and support from the tech community. The PHP Foundation posted a helpful article on what happened, which ends with a call for more sponsorship for their work. The majority of the internet relies on PHP, and other open source projects like it. We should support them.
How can you keep your website secure?
Unfortunately, we live in an age where cybercrime is an increasing problem.
These past two months, AI has been responsible for a lot of security releases across different types of software. Security releases are likely to be more frequent, so it’s important to be prepared.
Some things we’d recommend to keep on top of:
- Have a plan to apply software updates urgently and replace your website with a static HTML maintenance page if necessary.
- Always apply software updates and make sure you are using supported versions of software you use for your business.
- If you think you have a legacy system (a website or web app running unsupported software, or it hasn’t been updated for many years) get in touch and we can help audit this and recommend how to improve it.
- Get Cyber Essentials accredited (an excellent UK security scheme for businesses and organisations – Studio 24 is Cyber Essentials Plus accredited).
- Make sure you use a managed hosting, where the hosting provider is responsible for making software updates to things like PHP.
- Speak to us about a Penetration Test for a detailed security test of your website (especially important if you store personal user data).