PHP2Shell: how we protected your site this week

This week, PHP announced two critical vulnerabilities, known as “PHP2Shell.” PHP is the language behind a large share of the web, including WordPress. CISA, the federal cybersecurity agency, urged everyone to patch right away, because the flaws could let an attacker take control of a web server without logging in.

Our clients’ systems are patched, and here’s how we got there.

How we responded

• Tuesday evening, Oct 20: Our security team was watching alerts from CISA and other security sources as the news broke.
• Wednesday morning, Oct 21: Before PHP’s patch was even released, we added a protective rule to our web application firewall (WAF) that blocks this kind of attack.
• While we waited on the patch: We took systems that could safely go offline off the public internet, so we could focus on keeping production sites online and protected.
• Wednesday, 10 AM ET: PHP released the patches. Servers around the world tried to download them at the same moment, and we worked through the slowdowns.
• Wednesday, about 10 PM ET: All production systems were patched, roughly 12 hours after the fix came out.
• Friday, noon ET: Every system in our environment was patched, and the systems we took offline were back in service.

What Tectonic clients need to do

Nothing! If you have questions about your site or want details on your hosting environment, contact your account manager.

This is why we run security as part of our white-glove hosting instead of as an add-on. When something like this happens, the people watching the alerts are the same people who know your systems.

We can help

Plenty of organizations are still exposed, especially those on unsupported PHP versions or without a team watching for these alerts. If you know someone who’s still affected, we’d appreciate you asking them to consider Tectonic for hosting and web development. Feel free to contact us any time!