A vulnerability has been discovered in PHP

In the coming days and weeks, we will probably see more news about personal data leaks and compromised accounts. There is now a serious reason for that.

Two critical vulnerabilities have been found in PHP. In simple terms: under certain conditions, an attacker can make someone else’s server execute their commands. From there, user data may also be at risk.

Patches are already available. But sometimes the time between “the patches have been released” and “the patches have been installed” is... years.

You have probably heard the phrase “if it works, don’t touch it.” In the context of websites, that often means: the pages load, orders come in, so why spend money and time on updates?

An interesting fact, by the way: people have been declaring PHP dead for about twenty years. And yet it still powers a huge part of the internet. According to statistics, almost 70 percent of websites where the server-side language can be identified run on PHP. So the consequences of a problem like this can be large-scale.

I expect some companies to update quickly. Others will put it off. And some will only learn about the issue after their internal information has already leaked.

At Adal Cloud, we updated our PHP version as soon as the fixes were released, even though we only use PHP for the public website and it runs in a separate container.

And to owners of all kinds of businesses, I would suggest asking your team one simple question: “Does our website just work, or is it also updated regularly?”

It is better to get the answer before your customers read about themselves in the next data leak.