The PHP flaw behind last week's headlines

If your business has a website, there's a good chance it runs on a piece of software most owners have never heard of. Last week that software made international news. On October 21, the team behind PHP released an emergency fix for two critical security flaws that could let a stranger take over the server behind a website.

Some government websites in Europe briefly went offline while their operators scrambled. Here on Amelia Island, the stakes are smaller but just as real. A compromised site can leak customer information, redirect visitors to scams, or quietly get your business blacklisted by Google.

What PHP is, in plain English

Think of your website as a restaurant. Your pages, photos, and menus are what guests see in the dining room. PHP is the kitchen, the engine on the server that assembles each page when someone visits. WordPress, the most popular website builder in the world, runs on PHP, as do many online stores and booking systems.

By most estimates, PHP powers roughly three out of four websites whose underlying technology can be identified. That's why a flaw in PHP is a big deal. It isn't one company's problem. It touches a huge share of the internet at once.

The two flaws, nicknamed "PHP2Shell," are rated 9.2 out of 10 for severity. An attacker doesn't need a password to use them. Versions of PHP going back more than a decade are affected, and security firm Cloudflare reported seeing early attempts to exploit them almost immediately.

A bug found by artificial intelligence

What makes this story different is who found the problem. The flaws sat unnoticed in PHP's code for years. They were uncovered with the help of AI. Security firm Calif first spotted the issue using an OpenAI model, and the security company Wiz independently found and reported both flaws. OpenAI then spent two months coordinating a quiet fix with PHP's volunteer maintainers.

That plan went sideways when details leaked online two days before the scheduled announcement. PHP's team moved fast and released the fix a day early.

This is part of a larger trend. This year, AI models from several companies have dramatically sped up the discovery of hidden software flaws. That's good news in the long run, because bugs get found and fixed. In the short run, it means more urgent updates, arriving more often. Keeping your software current is no longer a once-a-year chore.

What to do this week

Here's the most important point. This flaw lives in PHP itself, not in your website. Updating WordPress or your plugins won't fix it. The fix has to happen on the server.

1. Find out who hosts your website. If you don't know, check your monthly or annual billing statements, or ask whoever built the site.
2. Check your PHP version. Most hosting control panels display it. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older needs attention.
3. Contact your host. Ask one simple question: "Have you applied the October 21 PHP security update to my site?" Get a yes in writing.
4. Watch for older sites. If your site runs PHP 8.1 or earlier, there's no simple update. It will need to move to a newer version, which should be tested first so nothing breaks. Plan ahead, because PHP 8.2 itself stops receiving updates on December 31.
5. Look for warning signs. Unfamiliar admin accounts, pages you didn't create, or customer complaints about strange redirects all deserve a closer look.

The bigger lesson

Most small businesses think of a website as something you build once and forget. This week is a reminder that it's more like a car. It needs regular maintenance, and every so often there's a recall you can't ignore.

You don't need to become a technical expert. You just need to know who is responsible for keeping your site updated, and to confirm they actually do it. If the answer is "nobody," now is the time to change that.

If you'd like a second set of eyes on your website, stop by Megabite at 816 Sadler Road or call 904-430-0350. We're always happy to point you in the right direction.

Deryck Burnett is the founder of Megabite, a technology, creative and multimedia company on Amelia Island. Reach the team at 904-430-0350 or Megabite.