PHP Emergency Update: What's Changed and What to Do Now
Earlier this week, we broke down the PHP emergency: two serious flaws in the software behind nearly 70% of websites, letting attackers take control of a website's server without a password. If you missed it, read our first post for the background.
Two days later, the picture is clearer, and it's not reassuring. Attack attempts have exploded, fixes are rolling out slowly, and government agencies have toughened their guidance. Here's what changed, in plain English, and what it means for your organization.
Attacks went from thousands to millions in a day
Cloudflare, which protects a large share of the world's websites, reported tens of thousands of attack attempts within 45 minutes of the announcement. That grew to hundreds of thousands within two hours, and millions by Thursday morning, according to The Hacker News.
There is some good news. As of today, security firms including Sophos and Wordfence report no confirmed successful break-ins. Most of the activity so far is attackers scanning the internet for vulnerable websites, and Sophos says they appear to be struggling to build a reliable attack.
That window won't stay open long. Researchers at VulnCheck have already shown a way around one of the biggest technical obstacles. Meanwhile, attackers are actively trying to hijack vulnerable servers and add them to a botnet, a network of compromised machines used to knock other websites offline.
Most websites still haven't been fixed
The fix only works once whoever runs each website installs it, and that's happening slowly. Qualys found only about 199,000 PHP systems were updated in the first 12 hours. As of today, internet-scanning firm Censys still counts more than 34 million vulnerable PHP services online.
The bigger problem is age. Qualys estimates that 71% of PHP systems, roughly 110 million, run versions so old the PHP team won't fix them at all. For those, the only real fix is upgrading to a newer version, which can take weeks.
Experts expect a long tail, comparing this to Log4Shell, a 2021 flaw that lingered for years. Many websites and business tools will stay exposed until the vendors behind them release their own updates.
Small businesses and everyday business tools are caught in it
This is not just a big-tech problem. An analysis by data firm Veridion, cited on Wikipedia's PHP2Shell page, found about 7 million companies running an affected version of PHP, most of them with fewer than 50 employees. That describes a lot of law firms, CPA firms, and professional practices.
The business tools you rely on are feeling it too. HR platform BambooHR temporarily took its service offline as a precaution while it applied updates. Government, school, and hospital websites across Asia, Europe, and North America also went dark while fixes were applied, and the UK government reported 32 of its digital services unavailable.
Insurers are paying attention as well. Insurance Business reports that cyber underwriters see this as close to the scenario they've long feared: one shared piece of software exposing thousands of policyholders at once. Don't be surprised if it comes up at your next renewal.
Government guidance got tougher: update it or unplug it
Agencies have moved past "patch soon." CISA now says organizations that can't update immediately, or that run older, unsupported versions of PHP, should take those systems offline until they're fixed. The UK's National Cyber Security Centre gave similar advice and has sent roughly 50,000 warnings to businesses and other organizations.
The PHP team has been just as blunt. Temporary workarounds can reduce risk, but they don't make a system safe. Installing the update is the only complete fix.
Taking a website or client portal offline is disruptive. It's far less disruptive than explaining to clients why their documents were exposed. This is a decision your leadership should make with your IT provider, not one to leave on autopilot.
What to do now
If you already reached out to your IT provider after our first post, good. Now follow through. If you haven't, start today.
Get a clear yes or no for every system. That includes your website, client portal, and internal tools. Two days in, "we're working on it" is no longer enough.
Decide what happens to anything that can't be fixed right away. If a system is too old or can't be updated yet, decide with your IT provider whether to take it offline until it can, as CISA recommends.
Check with your vendors. Ask your portal, payment, HR, and document providers to confirm in writing that they've applied the fix. If your website runs on a common hosting platform, ask your host whether it has updated; cPanel and Plesk, two widely used ones, have already released fixed versions.
Ask whether anyone looked for intruders. Attacks started before the fix existed. Installing the update doesn't tell you whether someone got in first.
Write it down. Record what was checked, who confirmed it, and when. Clients, insurers, and regulators may ask, and a written record is your proof.
The bottom line
No confirmed break-ins yet is good news, but it's a head start, not an all-clear. Attackers are actively working on this, and millions of systems are still exposed. The organizations that come through it well will be the ones that can show, not just say, that they're protected.
That's the heart of Evidence-Based Security & Accountability. Shield IT Networks works alongside your existing IT provider or team to verify what was done, document it, and close the gaps.
If you're not sure where your organization stands, a Cyber Readiness Assessment will give you a clear, documented answer.
Sources
The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Greenbone: PHP2Shell Remote Code Execution (includes CISA guidance)
Staffing Industry Analysts: PHP vulnerabilities impact BambooHR, Bullhorn and others
Insurance Business: UK councils and Met Police among sites pulled offline
Comments