Response to the PHP2Shell Vulnerability
Approximately two weeks ago, on October 20th, an extremely serious security flaw was disclosed for PHP—the software that powers the vast majority of web servers and roughly 70% of websites. If you have seen recent news coverage regarding the "PHP2Shell" vulnerability, that is what this refers to.
On Wednesday, October 21st, we started receiving urgent advisories from our software vendors recommending immediate updates to patch the vulnerability. By the end of the day, we had deployed the updates across our infrastructure and verified that all servers were no longer running versions of PHP susceptible to the flaw.
While official PHP maintainers released patches for versions 8.1 through 8.5, cPanel (our server management vendor) also provided backported updates for older versions down to 7.4. Additionally, we installed security-patched builds for older legacy sites still relying on PHP 5.6, and updated our server-side security software rules to proactively block any exploit attempts.
We normally make a point of thoroughly testing server configuration changes before rollout to prevent compatibility issues or disruption. However, given the severity of the PHP2Shell vulnerability, we acted immediately. If you notice any unusual behaviour on your website, it may be related—please reach out and we will look into it for you right away.
As of this writing, we have no indication of any active, ongoing attempts to exploit this vulnerability against our servers, and zero indication of any successful compromises.
