Critical PHP fixes land tonight. Is your website ready?

If your website runs on PHP, and most do, tonight matters. PHP’s developers will release fixes for two critical security flaws at 10pm Perth time, and attackers may move fast once they’re out.

PHP announced the security release on 20 October. It’s set for 14:00 UTC on Wednesday 21 October, which is 10pm in Perth and 1am on Thursday 22 October in Sydney and Melbourne.

Two flaws rated 9.2 out of 10

PHP says the release “addresses two critical vulnerabilities, both rated CVSS v4.0 9.2”. It hasn’t said what they are or which versions are affected. Those details will come with the fix.

All PHP users should prepare now to upgrade as soon as it’s out. PHP may release earlier if details become public or attacks start.

The Australian Cyber Security Centre issued a critical alert on 21 October, saying “all PHP versions from PHP 5 onwards may be affected”. It isn’t aware of attacks so far.

Why the rush

PHP runs behind a huge share of the web. W3Techs says 69.3% of websites whose server language it can identify use it. It powers WordPress and many online shops, including WooCommerce and Magento stores.

Security firms say word of the flaws got out early. Huntress reports that details leaked online on 20 October, in a post that was later removed. Sansec says a screenshot of an exploit tool called “PHP2Shell” also leaked, and expects mass attacks within 15 minutes of the release. PHP hasn’t confirmed those reports, but the warning is clear enough to act on.

The fix happens on the server

You can’t patch this from inside WordPress or your shop’s admin panel. PHP is the software your web server runs, so the update happens there. Sansec puts it plainly: “You cannot fix it from within your store codebase.”

Who does that depends on your hosting:

• Shared or managed hosting: your host usually updates PHP for you. Ask when.
• Your own server or VPS: you or your developer need to install the new version.
• Docker or containers: the image needs rebuilding with the new PHP version.

Old PHP versions are the worry

PHP currently supports versions 8.2, 8.3, 8.4 and 8.5. Older versions, including 8.1 and everything in the 7 series, no longer get security fixes under PHP’s support policy. PHP hasn’t said whether it will make an exception this time.

That matters, because plenty of sites lag behind. W3Techs counts 27% of PHP sites on version 7 and 7.7% on version 5, and some version 8 sites are on unsupported 8.0 or 8.1. PHP 8.2’s support ends on 31 December, so sites on it should plan to move too. If your site is on an old version, ask your developer about moving it to a supported version. Check that your plugins and theme work on it first.

Not sure what you’re on? Your host or developer can tell you. For help choosing a host that keeps on top of this, see our guide to website hosting costs in Australia.

Checklist

• Find out which PHP version each of your sites runs. Your host or developer can tell you.
• Ask your host when they’ll install PHP’s 21 October security release. It’s due at 10pm Perth time on 21 October (1am AEDT on 22 October). Also ask what they’ll do for sites on PHP 8.1 or older.
• Book in your developer if you run your own server. Shared hosts usually patch PHP for you, but a VPS or container setup needs someone to install the new version.
• Plan a move off PHP 8.1 or older. Those versions no longer get security fixes from PHP, and PHP 8.2’s support ends on 31 December. Test your plugins and theme on a supported version before switching.
• Check your site after the update. Load your home page, contact form and checkout to make sure nothing broke.
• Report anything suspicious to the ACSC. Call 1300 CYBER1 (1300 292 371) if you think your site has been attacked or you need advice.