What happened

On 21 October, the PHP team released urgent fixes for two flaws that could let an attacker take control of a website without logging in. Cybersecurity agencies have told website owners to update straight away. It wasn’t caused by WordPress or by anything your team did. The flaw is in PHP, which WordPress and many other platforms use. It affects websites built on any PHP-based system, which is most of the web. Even government sites like https://www.cyber.gov.au/ and https://www.abs.gov.au/ took their sites down for a period of time.

What we’ve done so far

Our care plan clients get PHP updates handled routinely to help their sites stay secure; so 99% of our clients have nothing to worry about and there is no response required. 

FAQs

What is PHP?

PHP is the programming language that runs most of the world’s websites. It runs on the server that hosts your site, behind the scenes. When PHP releases a security fix, the server and the website both need to be on a version that receives it.

Is this a WordPress problem?

No. The flaw is in PHP, which WordPress and many other platforms use. It affects websites built on any PHP-based system, which is most of the web. Even government sites like https://www.cyber.gov.au/ and https://www.abs.gov.au/ took their sites down for a period of time to apply additional security measures.

Has my website been hacked?

We check for signs of a problem as part of our routine reviews. If we ever find signs your site has been compromised, we’ll tell you straight away and help you work out next steps.

What does my care plan include?

See our care plan inclusions here. All plans include necessary WordPress, theme, plugin and PHP version updates your site needs, plus daily backups. 

About 1% of the websites we host (i.e. heavily customised themes, very old websites on legacy technology, and sites we didn’t build that have third party code) are not able to be updated reliably. Larger jobs may need to be quoted before we start, and some sites require a full rebuild on modern in order to be secured. If you’re already on the Redback Premium or Redback Advanced care plan, you have nothing to worry about.

Why can’t you just upgrade my website?

Each new PHP version retires some older ways of writing code. Most sites move across with small tweaks, which we handle for you. Older sites can rely on code the new version no longer supports. Upgrading those sites without fixing that code first can break forms, pages or the whole site.

Why do I need to change hosting?

The provider behind our Standard plan hasn’t indicated it will release a fix for this flaw. We don’t want your site waiting on that, so we recommend moving it to WP Engine (Redback Premium or Redback Advanced care plan), where the fix is already in place. Please email our team if you’d like to organise that.

Will this cost me anything?

The PHP upgrade, your site review and any hosting move are included in your care plan with us. If your site needs more than a small fix, or a rebuild, we’ll explain why and give you a quote before any work starts. If your hosting changes, we’ll take you through the new monthly fee on a call.

What happens if I don’t want to do anything?

Your site would stay exposed to a flaw that attackers are already trying to use. 

What happens next?

Your email from us explains the next step for your site. If we’ve offered a call, please book in a time that suits.