PHP2Shell: Vulnerabilities. What businesses should check.

PHP in business applications

PHP is a programming language typically used on servers. It provides the technical foundation for systems such as:

• WordPress
• Joomla
• Drupal
• Magento

Businesses can therefore use PHP without developing software themselves, for example through a company website, an online shop or a customer portal.

Work with your IT team or web agency to compile an inventory of all websites and applications. Include older online shops on subdomains and administrative applications that are rarely used. Updating the main system does not mean that other PHP installations are also secure.

PHP updates on the server

WordPress and plugin updates generally affect only the website software. PHP is updated separately on the server. Depending on the hosting arrangement, this is the responsibility of the hosting provider, the IT service provider or the internal IT team.

An “All updates installed” message in the website administration area does not confirm that PHP security updates have also been applied.

Coordination with your hosting provider and IT team

Confirm the following with your hosting provider or IT team for each website and application:

• Which PHP version is currently in use?
• Who is responsible for installing the security updates?
• When will the updates be installed after their release?
• Who will then verify the PHP version and check that the application works correctly?

Document the answers for each PHP installation. This makes it possible to track where responsibilities or dates still need to be agreed.

Managing older PHP versions

The PHP project currently provides security updates for the PHP 8.2 to 8.5 release branches. Regular support from the project has ended for older versions.

If your business uses an older PHP version, check whether your provider supplies its own security fixes. Otherwise, a move to a supported version is required. Have the application and its extensions checked for compatibility and correct operation as part of the upgrade.

Temporary protective measures

If a potentially affected application cannot be updated promptly, CERT-EU recommends considering temporary isolation from public networks. Work with your IT team to assess the potential consequences of an attack and suitable measures to restrict access.

For internal applications, restricting network access to authorised users may provide a temporary solution. The information published so far does not establish a need to take all websites offline.

Backups and functional testing

Ensure that a current backup is available before updating. Afterwards, have your IT team verify that the patched PHP version is active and the application works correctly. Testing should cover login, forms and, for online shops, the checkout process.

If there are signs of unauthorised access, installing updates alone is not sufficient. Your IT team must also investigate whether files have been modified or attackers have created additional ways to access the system.

Support with your application inventory

We work with you to identify the applications and PHP versions in use. We then coordinate responsibilities and the necessary steps with your hosting provider or web agency.