This Wednesday, the PHP developers urgently released patches. PHP is the "language" in which many sites and software are written. Two serious flaws could allow hackers to take control of a site without needing to authenticate.
Here’s what a manager should take away from this, without jargon.
The story in one image
Imagine a building whose front door has a manufacturing defect. No matter how good the lock on your apartment is: a stranger can enter the lobby.
The problem therefore does not come from your site or its content, but from the foundation on which it rests. Experts rated each flaw 9.2 out of 10, and CERT-EU is urging to install the patches as soon as possible. It’s the only 9.2 rating that no one boasts about.
Which applications are affected?
The answer can be summed up in one sentence: any application running on an unpatched PHP server. The official advice is to update any installation that serves web requests, regardless of the execution method used. The flaw lies in the language itself, not in each software. Therefore, every application built on it inherits the risk as long as the server is not up to date.
Here are the most common families.
Showcase sites and blogs
- WordPress, Joomla, Drupal, TYPO3
Online stores
- WooCommerce (the WordPress store extension), PrestaShop, Magento, Shopware
Business management software
- Dolibarr, GLPI (IT asset management and support), SuiteCRM
Collaborative and training tools
- Nextcloud, Moodle, MediaWiki, Matomo, phpMyAdmin
Custom developments
- Any application written with Laravel, Symfony, or directly in PHP, including sites created by a former provider
This list is indicative and not exhaustive: PHP powers a large part of the web. One point requires caution: some software includes its own version of PHP, particularly in containers, on storage devices, or in turnkey installation packages. For those, updating the server is not always sufficient. The software itself must also be updated.
Should we panic?
No, but we shouldn't wait. The fixes already exist. Moreover, no real and reliable attack has been publicly demonstrated to date. On the other hand, the information leaked before publication, with a video of a tool supposedly meant to take control of known sites. Caution remains advisable.
The real problem: the update that is dragging on
Fixing the door is simple. Someone just needs to do it. Everyone knows the property manager who has promised to fix the elevator "very soon" since 2019.
The numbers confirm it. According to a study by Censys, over 70% of analyzed WordPress sites run on outdated PHP versions. The reason is human: updates often cause incompatibilities with old plugins, and many administrators postpone them.
There is also a trap: some hosting services display an updated version while the server has not changed. It’s the equivalent of a reinforced door in the brochure and a latch on site.x
The four questions to ask your host starting today
- Is my site affected by these two flaws?
- Has the fix been installed on my server?
- Who installs it during the next alert?
- Will my plugins pose a problem after the update?
If the answer is delayed, that is already an answer.
And at ANOR?
Our clients' sites are powered by Odoo, which is written in another "language," Python. They therefore reside in another building and are not affected by these two flaws.
We do not claim that this neighborhood is free from everything, as none are. The difference lies in how it is managed. We monitor a single entrance door and not forty small doors forgotten in a basement. Our clients benefit from a team that knows their file and not a jack-of-all-trades. Updates are made without us having to request them.
Clients who still maintain an old PHP site are still concerned as long as the fix is not installed. They should call us.
In summary
A defect can be repaired in one day. A good maintenance habit is built over years. If your site still lives in the old building, ANOR organizes the move to Odoo. Boxes are provided. Humor remains optional.