What Scottish Businesses Need to Know About the PHP Vulnerability PHP2Shell: Is your website safe?

Yesterday, the National Cyber Security Centre (NCSC) warned UK organisations about a critical PHP (PHP: Hypertext Preprocessor) vulnerability that security researchers have named PHP2Shell. We have checked every system we manage, and none of our customers are affected.

Checking your own website? Avoid the free “PHP2Shell checker” sites that have appeared since the alert. Some are set up by scammers to collect your details, and even genuine ones only check part of the picture. Follow the NCSC’s recommended steps or speak to your web provider instead.

The engine room behind your website

When someone visits your website, a computer called a web server builds the page and sends it to them. On most of the web, that work is done by a programming language called PHP.

PHP works behind the scenes on the server, so you never see it when you visit a website or update your own. Your web developer or hosting provider chooses it and looks after it, which is why few business owners have heard of it.

It runs around 69% of websites whose server-side language is known, including:

• WordPress sites, the go-to for tradespeople, solicitors, accountants and local service firms across Scotland

• WooCommerce and Magento shops, used by independent retailers, food and drink producers and gift shops selling online

• Booking and enquiry systems, the kind hotels, B&Bs, restaurants and visitor attractions use to take reservations

  
  

What PHP2Shell allows an attacker to do

A vulnerability is a weakness in software that someone can exploit. PHP2Shell is made up of two related vulnerabilities, and together they can let an attacker take control of a web server from anywhere, without a username or password. Once in, they could copy customer data, change your website, leave a hidden way back in for later (known as a backdoor) or move from the website into the rest of your systems.

That is why both flaws were rated 9.2 out of 10 for severity. To make matters worse, details leaked online a day before the fix was released, which meant attack attempts were already being reported before many businesses even knew there was a problem.

Is your version safe?

The PHP Foundation has released fixes for the versions it still supports.

PHP version	Status	What to do
8.2 to 8.5	Supported	Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35
7.4 to 8.1	No longer supported	Upgrade to a supported version
7.3 and earlier	No longer supported, no fix available	Upgrade urgently or take offline

How we confirmed our customers were safe

PHP can sit inside websites, servers and other suppliers’ software without anyone being aware of it. So our engineers:

• found every place PHP was running across the systems we look after

• confirmed none of it was exposed

• checked for signs of attempted access with our security partner Huntress

We found nothing, and we will keep monitoring as more details emerge. Our own website runs on a fully managed platform that doesn’t use PHP, so it was never exposed.

If someone else runs your website

Ask your web agency or hosting provider:

• Does our website run on PHP?

• Which version is it on, and has it been updated?

• If it can’t be updated, what is the plan?

If a system can’t be protected in time, the NCSC advises taking it offline until it can be.

Why the businesses that coped best were not lucky

Alerts like this arrive several times a year, and they are coming faster as automated tools get better at finding flaws. The businesses that got through without disruption knew what they were running, kept it updated as routine and had someone watching for unusual activity. That is the work of good patch management and round-the-clock threat monitoring.

If you are unsure what your business runs or who keeps it updated, our cyber security team can help you find out.

.