If your agency builds or looks after client websites, I'd deal with this one today. On 21 October the people behind PHP, the code under WordPress and a bunch of other websites, fixed two critical holes that can let an attacker run code on a web server without logging in. Together they've been given a name, PHP2Shell, and on 26 October the US cyber agency added both to its list of flaws being used in real attacks.
I'm no security specialist. I'm writing this because the fix sits somewhere most people at an agency wouldn't think to look, and one simple email gets it checked.
Why updating WordPress won't fix PHP2Shell
PHP sits underneath WordPress, so the plugin updates your team runs don't touch it. The BBC put it plainly: the fix "must be applied to PHP itself and cannot be resolved by updating WordPress or its plugins". So a client's dashboard can look completely fine, with every plugin up to date, and the site can still be exposed.
That makes it a job for whoever runs the server, which for most agencies means a hosting company. They may well have done it already. Honestly, I'd still want that in writing, because if a client's site gets hit, "I assumed the host had it" won't go down well.
How serious this has got
PHP's own advisory says all installations serving web requests are at risk, and tells everyone to update immediately. The National Cyber Security Centre urged UK organisations to take immediate action, starting by finding every system running PHP, with anything facing the internet first. And the BBC reports the flaws sat undetected for more than a decade, that "it took AI to bring them to light", and that one researcher expects more attempts to exploit them in the coming weeks now the technical details are public.
That AI line is why it caught my eye. I spend most of my time on what AI does for a team's week, and this is a useful reminder that it's also finding old holes in the things your clients' sites run on.
The email to send today
Send this to whoever hosts each client site, with the sites listed at the top:
"Have you updated PHP on these sites to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your provider's patched version? Do any of them run PHP 8.1 or older? PHP no longer updates those, so they'd need a plan."
Those version numbers come straight from PHP's advisory. I've left in "your provider's patched version" because PHP says Linux distributions and long-term support vendors got the patches in advance, so a host can be protected on a different version number. If that's what they tell you, ask for the date they applied it and keep the reply.
If you've got developers looking after their own servers, there's one more for them. On 23 October PHP's team also suggested setting session.upload_progress.enabled=0 until its next regular release, to protect against an unlikely related issue. They should read the whole advisory too.
If a site's on PHP 8.1 or older
PHP 8.1 and older no longer get updates from the PHP project. Some distributions and vendors have backported fixes, and PHP's security team has put out minimal fixes for 7.4, 8.0 and 8.1 for people building from source. For most agencies the real job is moving the site to 8.3 or newer, since PHP stops fixing 8.2 on 31 December, and on an old site that's rarely a five-minute job, so give it an owner and a date.
PHP's page also lists temporary settings that reduce exposure, and says they don't make an installation safe. The BBC reports the US National Security Agency told organisations to take their systems offline if they couldn't patch straight away, so if a host can't give you a date, that's a conversation to have with the client.
What to do with the replies
Keep it simple: one sheet with each client site, who hosts it, the PHP version, the date it was patched and who confirmed it. If a site was patched late, ask whether they've checked it for signs of a break-in, because the NCSC says anyone who couldn't update straight away should look for evidence of compromise and backdoors. Chase anything without an answer by the end of the week, then tell your clients which sites are patched. It's a one-line email, and it's the kind of boring check that's easy to assume someone else has done.
While you've got that list of client sites open, it's a good week to look at the other boring one, where your client data goes when your team uses AI.
Most of my work is helping agency teams use AI well on real client work, if that's ever useful.