If you saw headlines last week about a “global cyber-security alert,” you may be wondering whether your business website is at risk.
You’re not alone. Government agencies, councils, universities and big tech companies all scrambled to respond.
The good news? A fix has been available since 21 October, and there were no confirmed reports of successful attacks at the time of writing.
The less good news? If your website hasn’t been updated since then, it’s worth checking now.
What about our customers?
As soon as we learned about the PHP security flaws, our team got straight to work. We checked every website we host and maintain, applied the fixes and confirmed they were in place. So if E2TS hosts and maintains your website, there’s nothing you need to do. It’s already been taken care of, and your site is protected against these flaws. If you have any questions, just get in touch and we’ll be happy to talk it through.
For everyone else, let’s break down what happened, what it means, and what to do next.
- What Is PHP (And Why Should You Care)?
PHP is a behind-the-scenes tool that helps websites work.
When someone visits your site, PHP helps pull together the text, images and information, then builds the page they see on screen. Think of it as the kitchen in a restaurant. Customers never see it, but nothing reaches the table without it.
It’s been around for decades and is used by an estimated 70% of websites, including WordPress, which powers a huge number of small business sites in the UK.
So even if you’ve never heard of PHP, there’s a good chance your website uses it.
- What Actually Happened?
Last week, security researchers revealed two serious weaknesses in PHP itself. They had been sitting there, unnoticed, for around ten years.
If a hacker found the right way in, these weaknesses could let them take control of a website’s server and access private information.
They were rated 9.2 out of 10 for seriousness. That’s about as high as it gets.
The researchers used advanced AI tools to scan the code, which found in a short time what people had missed for years. The same technology could, in the wrong hands, help criminals find weaknesses faster too. It cuts both ways.
- How Serious Is It Now?
Here’s the balanced picture:
- No successful attacks had been reported at the time of writing
- Attempts, however, have been huge. One major internet company reported millions of attempts to exploit the flaws within hours of the news going public
- Some organisations took sites offline as a precaution, including councils, universities and government services
- A patch (a fix) was released by the people who look after PHP on 21 October
- Experts expect more attempts in the coming weeks now that the details are public, particularly against sites that haven’t been updated
In short: the danger is real, but the fix is already out there. Acting quickly makes a big difference.
- Does This Affect My Business?
Possibly. It depends on how your website is built and who looks after it.
Your site could be affected if:
- It’s built on WordPress or a similar platform
- It’s an online shop
- It uses booking forms, customer logins or customer databases
- Nobody has checked or updated it recently
It’s also worth knowing that PHP can sit behind the scenes in other places, such as the control panels of some business network equipment, so it isn’t only websites that are affected.
Smaller businesses with older, unmaintained websites are at greater risk, simply because they’re less likely to have been updated.
- What Should You Do?
Fix it:
- If someone manages your website for you, contact them today and ask one simple question: “Has the PHP security update been applied?”
- If you manage it yourself, you’ll need to update PHP on your hosting. This is your responsibility, so check with your hosting provider if you’re unsure how
- Don’t assume updating WordPress or your plugins is enough. The fix needs to happen at the PHP level, which is a separate update
- If it can’t be updated quickly, the UK’s National Cyber Security Centre suggests considering taking the site offline temporarily until it’s protected. It’s inconvenient, but far better than the alternative
- Watch Out for Scams
Whenever a story like this hits the news, scammers follow.
Be cautious of emails or messages claiming your website has been hacked, asking you to “verify” details, or telling you to change your password via a link. If you’re unsure, don’t click. Go directly to the official website of the service in question instead.
Bringing It All Together
This isn’t a reason to panic, but it is a reason to act.
The fix has been available for almost a week. For most businesses, applying it is a quick job if you have the right people looking after your website. The bigger risk is doing nothing and assuming it’s someone else’s job.
At E2 Technology Solutions, we help businesses build and maintain secure, high-performing websites that don’t leave them exposed. Our website maintenance package is built for exactly this, handling updates, security fixes and monitoring so you don’t have to think about it.
Not Sure If Your Website Is Protected?
If you’re unsure whether your site has been updated, or you don’t know who looks after it, we can help you find out quickly.
Get in touch with E2TS today and we’ll point you in the right direction.