Spare a thought for the technical teams working at your favourite websites, or even possibly for government agencies, because they might just need a pat on the back for the spot of good work they’ve been doing today.
If you’ve noticed the web has felt a little slower or even possibly slightly switched off to end the week, there’s a good reason why: one of the major parts of what makes a lot of websites tick saw a huge problem or two, and it may have affected websites you rely on.
Every website runs on a platform a little like an operating system for the serving of websites, and this week, the world’s most used web platform — PHP — saw major vulnerabilities detailed for it. The issues were so severe, they carried risks potentially allowing hackers to break in and take control of servers, making for a difficult time for anyone who runs a website.
If you run a blog, your website might run on PHP. If you use WordPress, it very likely runs on PHP. In fact, if you run a shop or company site or even run your very own news and magazine website, there’s a good chance you lean on PHP. And if you do, you need to make sure that server gets updated fast.
The two vulnerabilities affect every unpatched version of PHP, which until the early hours of October 22 in Australia, was also any and every edition of PHP, whether it was really old or really new.
Originally found by AI, the flaws run the risk of letting someone into your server and giving them permission to execute code remotely, even without permission. As of the last week of October, however, the patches are out in the world, and owners of websites can install them, finding ways to stop the exploits before they get potentially nasty.
For IT teams and web admins, it means there’s a way to help safeguard the sites we all rely on. But these fixes can also take time, and that may mean sites you like and sites you rely on could be out of action for anywhere between a few hours to a few days.
That’s worth being aware of over the coming days, simply because not patching a site means risking major problems in the future.
What if I have a site: do I need to do anything?
If you do happen to have a site, such as for a small business or something else, you may want to get in touch with the technical team running it ASAP and find out what they can do. And if you run that site yourself, it’s time to roll up your sleeves and potentially get your hands dirty.
In most of the instances Pickr had checked out, web hosts were actively working to patch their systems and deal with the exploits, potentially preventing a cataclysmic and complicated situation. The shared hosts that usually mean an inexpensive blog will likely be the first to get an update, with the more expensive managed hosts also seeing updates.
As it is, by October 23 within the space of a day later, many of the large hosts were ready, and had found ways to roll out the changes.
But a lot of older sites will be incompatible with these changes, and that could spell disaster. In some instances, older sites are often just left the way they are, sticking with the phrase “if it ain’t broke, don’t fix”. If websites are like this and too out of date, they may need to be taken offline until an expert can work out how to do that: fix a problem that didn’t exist before this week.
As to how many sites that is, the answer is likely many, and even includes some big ones, so if you are included, you’re clearly not alone.
But the advice is clear: deal with it ASAP. Anything less and you could be taking too big of a risk.
