A serious security flaw was found in PHP, the software that powers most websites. Here is what it means, what we have done about it, and how to check a website hosted anywhere else.

The short version

• If your website is hosted with Elgon Web Hosting, you do not need to do anything. We have already updated our servers.
• We are watching our servers closely and will keep doing so.
• If you also have a website hosted elsewhere, the three checks at the end of this post take about ten minutes.

What is PHP, and why does this matter?

Think of PHP as the engine under the bonnet of your website. You never see it, but every WordPress site, online shop and booking form depends on it to work. Because so many websites share the same engine, a weakness in PHP is a weakness for a huge part of the internet at once.

This month the PHP team announced critical flaws and released updated versions that close them. Serious flaws like this one can let an attacker take over the server a website runs on without needing any password, so they are treated as urgent. Once a flaw is public, criminals scan the internet within hours, looking for servers that have not been updated yet.

What we have done

• Updated PHP on our servers to the fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• Moved every client website to a supported, patched PHP version. Older versions such as PHP 8.1 and below no longer receive security fixes, so we upgraded sites still using them and checked each one afterwards.
• Kept Cloudflare protection in front of every site. All the websites we host sit behind Cloudflare, which filters out malicious traffic before it reaches your site.
• Monitoring. We are keeping a close eye on our servers and will act quickly if anything changes.

Have a website hosted somewhere else? Check it in 10 minutes

1. Find your PHP version. In your WordPress dashboard, open Tools → Site Health → Info → Server and look at “PHP version”. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. If it shows 8.1 or lower, that version no longer gets security updates and should be upgraded.

2. Ask your hosting company directly. Some hosts patch servers without changing the version number, so the only way to be sure is to ask. You can send something like this:

“Hello, I have read about the critical PHP security flaws announced this month. Could you please confirm in writing whether my hosting has been updated, and which PHP version my website is running?”

3. Back up your website first. Before any updates are made, take a full backup of your files and database so you can always restore your site if something goes wrong.

Good habits that keep you safe all year

• Keep WordPress, your theme and your plugins up to date, and delete plugins you no longer use.
• Use strong, unique passwords for your website and email, and never share admin logins over chat.
• Make sure regular backups are being taken, and that someone knows how to restore them.
• Choose a host that applies security updates for you instead of leaving it to chance.

There is no need to panic

Problems like this are found from time to time, and the fix is usually quick. The websites at real risk are the ones nobody is looking after. If you are an Elgon Web Hosting client, that work is already done for you.

Not sure where you stand? Whether your website is with us or with another host, get in touch and we will check it for you and explain the answer in plain language.