From our side, we appreciate that AI has matured enough to detect these vulnerabilities that have been dormant in PHP for over 22 years - and long may this continue - as finding and fixing these vulnerabilities helps to create a safer and better Internet for everyone.
The two vulnerabilities, collectively known as PHP2Shell, could allow attackers to run malicious code on an affected web server without needing to log in. This could put website data at risk, allow content to be altered or cause services to be disrupted, making prompt security updates essential.
The last 48 hours have been an interesting time at Calm. Whilst the majority of our websites run on Python, not PHP, we do host a handful of WordPress and PHP platforms which would need to be upgraded and mitigated.
When we learned about the threats, our first step was to mobilise and find out what this meant for our websites. We began by disabling PHP completely on every server that deemed it unnecessary - this covered about 90% of the websites we maintain.
Fortunately, Ubuntu were ahead of the game and offered several clear upgrade paths for our servers - this meant that we could quickly and easily patch servers with minimal downtime. I’m pleased to say that the vast majority of websites were patched within 24 hours of the vulnerabilities first becoming public knowledge. Thanks to the whole development team at Calm, who helped make this possible, especially as we’re currently in the middle of Advent Calendar season.
Some good news: most of our services (including bespoke websites, software and the Propellr platform) utilise the Django framework on the Python programming language and have not been impacted by this threat. However, as part of our development lifestyle, we know that there could be similar threats in the future that do affect Python. A major component of our maintenance process is making sure that the software that runs websites is as up-to-date as possible and having regular upgrade windows to apply updates without impacting websites.
As always, the team at Calm are on hand and available via phone or email should you have any questions or concerns about the vulnerabilities and how they would impact your website. We can offer hosting packages that are fully protected against these threats and are happy to chat through any options.
Warm regards,
Dan Askwith - Technical Director
