PHP’s critical fixes are out. Has your website been patched?

If your website runs on PHP, the fix you were waiting for is out. Now the question is whether anyone has installed it.

PHP released fixes for two critical flaws on the evening of 21 October, Perth time. We covered the warning in our story before the release. Here’s what has changed since.

What the flaws do

Both flaws are rated 9.2 out of 10. PHP says they “can allow unauthenticated remote code execution”. In plain terms, an attacker with no login could run their own code on your web server.

Every PHP installation serving web pages is at risk, on every common server setup. The danger is highest for sites running PHP inside the Apache web server, where an attack works before your website’s own code even runs.

The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advice is blunt: “All PHP users are strongly encouraged to update immediately.”

WordPress can’t fix this one

WordPress says “no WordPress update is required or planned for these issues.” Updating plugins or WordPress itself won’t help.

The fix is a new version of PHP on the server. On shared or managed hosting, your host installs it. On your own server, your developer does.

Old PHP versions are in a bind

PHP 8.1 and older no longer get official updates. This time, PHP’s security team made an exception of sorts. It released minimal fixes for 7.4, 8.0 and 8.1, but only as source code for people who build PHP themselves.

PHP has released no fixes for 7.3 or older. Some hosts and Linux distributions may patch older versions themselves, so ask yours. WordPress says people running their own servers on PHP older than 8.2 should consider taking the server offline while they prepare to update.

PHP 8.2 also stops getting security fixes on 31 December. A site on 8.2 is fixed for now, but needs a move soon.

Attacks: claimed, not confirmed here

The ACSC updated its critical alert on 22 October to say patches are out. It still says it’s not aware of successful active exploitation in Australia, and urges organisations to apply the updates and watch for suspicious activity.

Cloudflare reports attack attempts. It says it “observed attack traffic targeting our customers”. It added protective rules for all plans, including free ones, on 21 October, but says customers should still update PHP.

The PHP Foundation says the flaws’ ID numbers leaked online ahead of time, which is why the release came a day earlier than first scheduled. It says it found no working exploits at the time of release.

If you take your site offline

SmartCompany reports some Australian businesses took their websites offline as a precaution while they waited for patches.

If you do, do it in a way search engines understand. Google’s John Mueller posted that sites going down for these updates should show an HTTP 503 status. That beats letting pages time out or show errors, and it can be served from your DNS or CDN provider if PHP itself is offline. Google says to take a site down only briefly, a few days at most.

For more on choosing a host that handles this kind of update for you, see our guide to website hosting costs in Australia.

Checklist

• Ask your host or developer whether PHP has been updated. Your site should be on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a patched build from your host.
• Don’t rely on WordPress or plugin updates for this. WordPress says none is required or planned; the fix is a PHP update on the server.
• Ask what your host is doing for PHP 8.1 or older. PHP’s regular releases skip them, and the only fixes for 7.4 to 8.1 are source code for people who build PHP themselves.
• Plan a move off PHP 8.2 before 31 December. That’s when PHP stops releasing security fixes for it.
• Use an HTTP 503 status if you take the site offline. Ask your developer to set it, through your DNS or CDN provider if PHP is down, and keep the outage to a few days at most.
• Contact the ACSC if you think your site has been attacked. Call 1300 CYBER1 (1300 292 371).