You may have seen reports in the technology press or national media on Wednesday 21st October, concerning a major security vulnerability affecting PHP.
Because PHP is the underlying programming language used by millions of websites globally, including WordPress, Drupal, Laravel and custom web applications, we want to provide a clear, plain-English summary of what has happened, what steps were taken on the day, and what this means for your organisation.
The short answer is: if eighteen73 manages your website or web application hosting, your site is protected, operating normally, and no action is required from you.
All managed websites and applications are safe and operating normally
What is the issue?
A critical flaw was disclosed in PHP that could allow unauthorised attackers to execute malicious code on unpatched web servers. Because PHP is so widely used across the internet, automated attempts to scan and exploit systems began quickly across the industry.
Security researchers and hosting providers have been working throughout the day to release and deploy fixes.
What steps were taken on the day?
Our technical team has been monitoring the situation and applying protections across our infrastructure throughout Wednesday:
- Perimeter protection: Early mitigations were rolled out at the network level (notably through Cloudflare for the majority of our websites). This filtered out known exploit attempts before traffic reached web servers.
- Temporary safeguards: While waiting for official vendor patches to become available, we closely inspected the actual vulnerabilities and put temporary protective restrictions in place on some servers. In some instances, this meant temporarily disabling file upload features to prevent potential exploitation without having to take websites offline. These restrictions have now been lifted and normal upload functionality is restored.
- Immediate server updates: Patched versions of PHP were released on Wednesday afternoon and fed through to our vendor channels in the evening. Rather than waiting for standard automated update cycles to apply them in the coming days, we have applied these updates manually across our managed servers.
Why were some news reports suggesting websites should be taken offline?
When an issue of this scale is discovered in a foundational web technology, initial public advisories can sound alarming.
Broad guidance suggested taking web servers offline as a precaution. That advice is typically aimed at unmanaged servers or organisations without active monitoring, where there is no immediate way to filter malicious traffic or deploy intermediate safeguards.
Because our infrastructure includes edge firewalls and carefully designed systems that we know inside out, we were able to protect sites in a surgical manner while keeping them live and accessible to your visitors throughout the day.
What you need to do
If eighteen73 manages your hosting and application, you do not need to do anything. All updates and checks have been carried out, and your website is operating as normal. If you have any questions, get in touch with either your regular account manager or support@eighteen73.co.uk
If your organisation operates any separate websites, portals, or internal systems hosted elsewhere with third parties, we recommend checking with those providers to confirm that the latest PHP security updates have been applied. Please contact us if you would like us to look into your systems for you.
