PHP2Shell

 approx 3 minute read

What happened and how we protected your websites.

On 20 October, details of two critical security flaws in PHP leaked online before a fix was ready.

PHP is the software behind most of the world’s websites, including every WordPress site.

If your website is hosted with Nettl, we had protection in place within 80 minutes of the first reported attacks, and every site was fully patched by 7am the next morning.

This post explains what happened, how we responded, and what keeps your site safe long term.

What happened

PHP is the programming language that runs on the server behind your website. Every time someone loads a page on a WordPress site, PHP is doing the work.

The two flaws were found in PHP itself, not in a single plugin or theme. Security experts rated both 9.2 out of 10 for severity.

In plain terms, they could let an attacker take control of the server a website runs on. Early reports suggest the weakness had gone unnoticed for around 10 years.

The details were meant to stay private until the fix was released.

Instead they leaked a day early, which gave attackers a head start.

Before the fix was even out, Cloudflare reported seeing the first attacks. The story made the BBC’s front page, and some companies took websites offline altogether while they waited.

How we protected your website

Cloudflare reported the first attacks at 8:45am on 21 October.

By 10:05am, our team had protective blocks in place across every site we host, keeping your website shielded while we waited for the official fix.

PHP released the fix at 3pm UK time on 21 October. Our team worked through the night to roll it out, and by 7am on 22 October every site we host was fully patched, including those on older versions of PHP.

With the patches in place, we lifted the temporary restrictions.

Some hosting companies left their customers to apply these changes themselves.

We did the opposite. The patches were applied for you, and because they’re backward compatible, your website still runs on the same version of PHP with nothing for you to change.

Why this matters beyond this week

Attacks like this are getting faster. AI tools now help attackers find and use a weakness within hours of it going public. The same tools also help us spot and respond to threats sooner.

This flaw appears to have gone undetected for around a decade. No one can fix a weakness before it’s found, but you can make sure someone is ready to act the moment it is.

This week’s fix was for PHP. Your website also runs WordPress, a theme and a set of plugins, and each of them gets security updates through the year. A site that misses those updates is the easiest kind to break into.

How a Care Plan keeps you covered

That’s the job of our Care Plans. Your site’s software is kept up to date and monitored for you, including the version of PHP it runs on.

Care Plan sites also get priority support from our technical team when something like this happens.

It means someone is looking after your website’s security, so you can get on with running your business.

If your site isn’t on a Care Plan yet, ask your local Nettl studio about adding one.