You may have seen headlines about a serious flaw in PHP. Attackers are already using it. It’s manageable if you know every place PHP runs. Here’s what matters, and what to ask.
Download the one-page printable version (PDF)
What is PHP?
PHP is the software behind a large share of the world’s websites, forms and logins. It has been around since the mid-1990s, so it often lives in places that are easy to overlook. Many organizations that don’t think of themselves as using PHP still have it somewhere.
What happened
On October 21, PHP released emergency fixes for two critical flaws. Either one lets an outsider take control of an affected server without a password. Attacks began before the fix was available, and on October 26 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed the flaws are being used in real attacks. Some older versions of PHP have no fix at all.
What this means for you
When news like this reaches leadership, the question goes down the chain and the answer comes back up: “It’s managed.” For the systems the team knows about, that’s usually true.
In our experience, the exposure is in the systems that are easy to miss: a vendor’s admin page, a marketing site built by a past agency, an internal tool nobody owns anymore. A few specific questions will show whether those have been found.
Six questions worth asking
How confident are we that we’ve listed every place PHP runs, including public sites and systems that vendors or outside firms run for us?
Does each one have a named owner? Systems without an owner are usually the last to get fixed.
Have the vendors that could be affected confirmed in writing that they’re fixed, or that they don’t use PHP?
Is any of it too old to fix, and what have we decided to do about it? Replacing it, taking it offline, or accepting the risk are all reasonable choices. The only unhelpful answer is that no one has decided.
Has anyone checked whether we were broken into before the fix was in place? Being fixed today doesn’t tell us whether someone got in earlier.
If we can’t rule that out, who decides whether to notify our insurer and customers, or bring in outside help?
If the answers come back clear and specific, you’re in good shape. If they’re vague, ask again in a week. Once the answers are in, ask which one took the longest. That’s what to fix before the next one.
