On Tuesday, October 20, someone posted on a public forum that two serious flaws in PHP were about to be announced. PHP is the programming language underneath about seven in ten websites, WordPress among them, so it sits underneath a good share of the shop, clinic and restaurant websites in Atlantic Canada too. The flaws let a stranger run their own code on a web server without logging in. Once the leak was out, attackers knew to start looking, so PHP moved its fix up by a day and shipped it on Wednesday, October 21 (Huntress).
The U.S. cybersecurity agency told organizations to patch immediately, and to take PHP systems offline if they could not (CISA). On October 26 it added both flaws, now known as php2shell, to its list of vulnerabilities being used in real attacks.
The person most people had never heard of
On a large share of Debian and Ubuntu servers, the fix arrived through packages built by one man. Ondřej Surý lives in the Czech Republic and leads DNS development at the Internet Systems Consortium, a nonprofit. In his spare time, for more than twenty years, he has turned PHP's source code into ready-to-install packages that a server administrator can apply across hundreds of machines with one command. He is a volunteer, paid in donations (blue News).
That week he also put out fixes for PHP 7.4, a version so old that PHP itself no longer supports it, and which plenty of servers still run anyway. One developer wrote on Reddit that he heard about the flaws at 2 a.m. and had everything updated by 3. In the next 24 hours Surý received about as much in donations as he normally gets in a year.
Charlie Warzel of The Atlantic called him up the next day, and the interview is worth reading whole. Surý comes across the way the best experts often do: calm, generous with credit, more interested in the work than in the attention. He told Warzel the week would only really have been stressful "if I'd been on a boat in the middle of the Adriatic." The interview ends with this:
“I would recommend that they rely on the experts. That’s what we all do in a crisis: We talk to experts and trust them. Rely on people, that people who take care of this stuff know what they are doing. And that’s all we can do.”
Why that answer matters more now, not less
It is a modest answer, and that is the point. In a crisis nobody reads the source code themselves. You call the person who knows, you trust them, and you let them work. A lot of servers were patched within hours that week because a few people knew exactly what to do and had been quietly doing it for years.
AI makes this easy to forget. A chat window will answer any question about PHP, servers or security in confident, tidy sentences, and most of the time it will be roughly right. What it won't do is notice at 2 a.m. that your site runs an old version nobody told you about, build the fix, and stand behind it. AI is the autopilot. You still need a pilot, which is the whole argument of our post on why AI needs a pilot. Surý put it better, and he had just spent a week showing it.
We would go a step further. The most useful thing an AI project leaves a small business with is not the tool. It is a named person who understands how the tool works, where it goes wrong, and how to switch it off. Tools get replaced every couple of years. That person's judgment is what carries over.
The other thing he said
Surý also told Warzel, "We can't go on like this forever." Read it next to the first quote. Relying on experts only works if the experts are looked after: paid, backed up, and not on their own. A big piece of the internet's defence that week rested on one volunteer's spare time, and he is now talking with a software company, Freexian, about who could carry the work on if he ever can't.
Small businesses have the same problem in miniature. The website, the bookkeeping setup, the new AI tool: each one usually depends on one person who knows how it works. Often a freelancer, a nephew, or the one keen employee. That is fine right up until that person is on a boat in the Adriatic.
What to do this week
- Find out who looks after your website, by name. If it runs on WordPress, it runs on PHP. Ask them whether the server's PHP was updated after October 21. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- If the answer is PHP 8.1 or older, ask what the plan is. PHP no longer supports those versions, and CISA's advice was to take them offline until they are updated.
- Name a backup. Same rule as in our post on change management for a five-person team: anything that belongs to one person stops when they go on vacation.
- Pay the people who keep things running, including the ones you never see. Surý takes sponsorship through GitHub.
How we try to work
Every engagement we run keeps a person signing off wherever money, safety or reputation is on the line, and ends with a plain-language runbook that includes the off switch. The aim is that when something goes wrong at 2 a.m., the expert who knows what to do is someone on your own team, and you know their name. If you are not sure who that is for the tools you already run, a free 30-minute call is a good place to start.