PHP (short for "PHP: Hypertext Preprocessor") is an open source server-side scripting language used by websites that run on most popular software products (such as Wordpress and Adobe Commerce) as well as websites built using core PHP. The flaw, which could allow hackers to take control of affected web servers and access sensitive data via unauthenticated remote code execution, has existed for several decades but was only recently been exposed by artificial intelligence (AI) tools. This prompted the PHP community to announce the flaw and rush out a fix.
We have been rolling out security patches to the PHP versions used on our server (namely 8.2.35 and 8.3.36) since the fix became available yesterday afternoon, and as such all websites hosted on our servers are now secure. However, if your website was built by us but is hosted elsewhere, you must still check whether your host has updated your PHP installation to one of the versions that has the patch applied:
- 8.2.35
- 8.3.36
- 8.4.27
- 8.5.12
Such is the threat posed by this flaw, the UK National Cyber Security Centre advises that you should consider taking your website temporarily offline if your website uses an older version of PHP and no immediate remedy is available.