We don’t do FUD marketing at Ultimately Better, so let me lead this post with some reassurance: if you’re a UB client with our managed WordPress hosting, or on one of our care and maintenance plans, you’ll have already heard from us today with updates on if/how you are affected, the steps taken to mitigate the risk to your website and data, and any recommended next steps.
Any clients on our managed hosting immediately received temporary WAF hardening or patches while we waited for PHP to release the official updates, and anyone running a version of PHP considered ‘end of life’ had rapid fixes deployed so that we could update PHP to a supported version so that it would immediately receive those patches once available.
Any of our non-maintenance clients will be receiving additional support within the next 24hrs to advise on any corrective action they need to consider.
What happened
On Tues 20th October the PHP security team gave advance notice of an emergency release to fix two critical vulnerabilities, both with CVSS v4.0 ratings of 9.2 (that’s really bad). The release was scheduled for 14:00 UTC (15:00 UK time) on Wednesday 21st October.
On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix (source). Cloudflare logged the first attacks against PHP sites shortly after.
PHP released the fixed versions at 14:00 as planned. These are currently being rolled out by our upstream hosting providers (and many other hosts worldwide!)
The vulnerabilities
Both vulnerabilities allow unauthenticated remote code execution. In other words, this allows someone with no login or privileges to run code on your web server. That code can read files, access databases, compromise customer data, plant malware and more.
Is this a WordPress thing?
No. The problem is in the coding language that WordPress (and many other platforms and services) are written in, not a problem with WordPress itself. WordPress can’t fix the issue, it has to be rolled out by your hosting provider.
I’m not a managed client, help!
If you’re an existing non-managed client, we’ll be in touch as soon as possible with any next steps that we recommend. If you’re not a client, but you’re concerned about the security of your website in light of the PHP vulnerabilities, or for any other reason, please reach out to our support team on help@ultimatelybetter.com and we’ll get back to you as soon possible.