Security Update: Critical PHP Vulnerability – Progress Report
Thank you to all of our clients who have worked with us today to help secure their websites. We're especially grateful to those who have moved their DNS behind Cloudflare to benefit from its Web Application Firewall, and to everyone who has upgraded their sites to PHP 8.2 or later.
We understand that many websites are not yet compatible with modern PHP versions. For WordPress sites, our team has successfully updated around 75% of the sites we've worked on today with other sites not working due to premium plugins not licensed etc. If you don't have a web developer, we're happy to try to help and make your site compatible with modern php for a small fee. Please open a support ticket to arrange this.
Progress so far
- Enhance Panel 2: All servers have been upgraded and patched.
- Private Enhance clusters: Around 80% patched, with completion expected by 11pm UK time tonight estimated
- cPanel servers: Updates are being applied now and will complete overnight.
- Enhance legacy (v11) servers: Patching is underway. These need a reboot, so progress is slower.
- DirectAdmin servers: All servers not running end-of-life CentOS 7 are patched. We'll contact clients on CentOS 7 servers over the next few days to arrange a required upgrade.
- CloudLinux servers: Patching will take place overnight.
Automated PHP upgrades
We're running an automated process across our entire fleet in Enhance that:
- identifies websites running outdated PHP versions
- takes a screenshot of each site
- upgrades it to a supported PHP version
- takes a second screenshot to check the site still works
- reverts the PHP version automatically if the site is broken
This process is currently 35% complete. Once it's finished, we'll email every client still on an outdated PHP version to remind them how important it is to update adn offer help where we can if the client does not have their own developer.
Why this matters
The UK National Cyber Security Centre (NCSC) has issued an alert about this vulnerability, and it has also been covered on the BBC News front page. Today alone, the NCSC has sent hundreds notifications to our abuse team about vulnerable websites. If your website doesn't work with a current PHP version, please treat fixing it as urgent.
How you can help us help you
For the next 48 hours, please use support tickets instead of live chat wherever you can. This lets our team work more efficiently and spend more time on upgrades.
We're committed to helping every client as quickly as possible, and we thank you for your patience and cooperation.
The BigWetFish Team
