PHP2Shell Vulnerability: Why Website Maintenance, Security and Managed Hosting Matter

Last week, security researchers and threat actors published details of a set of critical PHP vulnerabilities. Each rated 9.2 on the scale and deemed as severe as they can get. This vulnerability is now widely referred to as PHP2Shell. Of course, vulnerabilities happen regularly; that’s software, hardware and application 101. But what’s interesting is that this vulnerability pretty much mobilised web developers, hosting providers and most people in tech across the globe. 

Since the original research came out from Sansec and Huntress there has been a patch from PHP and that’s been rolled out across the globe. From a Big Gun Digital perspective, our actions were swift and we were able to manage things smoothly and methodically. 

We’re not writing this to add to the noise. Events like this happen a few times a year and often never make more noise than a stir in an industry forum. What vulnerabilities like this do is shine a light on what sometimes is considered unglamorous work that keeps websites safe and secure. So now things have calmed down, it seems like a great moment to talk about website maintenance, security and hosting and why infrastructure like this matters from a business continuity perspective long after the headlines have moved on.

As you can see, with it powering a lot of core infrastructure the flaw at this top level is so serious. It isn’t a problem with one plugin or one theme. It sits in the foundations, which means a single weakness can affect millions of websites at once, regardless of how well each one was built.

Diving into tech now, the most serious of vulnerabilities will allow an attacker to run their own code on a web server. In practical terms, this means:

• Defacing or hijacking of websites. 
• Stolen customer data, including enquiry details or order details. 
• Hidden malware or spam links that damage your Google Rankings. 
• Your site being blacklisted by browsers or ultimately being taken down by the host. 

For most SMEs, the website is the shop window, the sales team and the first impression all rolled into one. Losing it for a few days, or losing customers’ trust, costs far more than keeping it properly looked after.

When news of the PHP2Shell broke, our response was swift. We always use a similar process:

1. Assess. We took a look and quickly realised there was quite a major issue. With this vulnerability, all sites are affected. 
2. Communicate. We got in early with clients, let them know we were aware of the issue and on top of it, so nobody was left reading worrying headlines without context.
3. Monitor & Backup. While PHP prepared their fix, we kept a close eye on the sites as well as backed up every website manually and individually. 
4. Patch. Due to the severity of the issue, we were lucky to be supported by our third party hosts who patched the PHP version quickly. 
5. Check. Whilst things were settling down, we confirmed each site was running the new patched version of PHP and appeared correctly online.

Lesson One - a website is never “finished”

One of the most common things we hear is business owners saying “our website was built a few years ago and has been ticking along nicely since”. It’s an understandable perspective, once a site is live and bringing in enquiries, it’s easy to assume the job is done.

But a website is made up of many moving parts, and each one is updated regularly by its developers. That includes the server software and PHP version, your content management system such as WordPress, every plugin and theme you use, and the third-party integrations for forms, payments and tracking.

Every update fixes bugs, improves performance and, crucially, closes security holes. When those updates are skipped, the gaps stay open, and automated attack tools scan the web around the clock looking for exactly those sites.

Lesson Two - website security works in two succinct layers

Patching an open-source system is important. But it’s only one piece of the puzzle. No single measure introduced makes a site bulletproof, which is why layering in other security measures is helpful. To quote the philosophical being of Shrek, onions have layers and so does website security. If one is breached, there’s another layer that can stop, delay or dampen an attack. We have a robust level of security in place for clients at Big Gun, but some things I’d recommend if you are concerned about security and don’t have anything in place are:

• Web Application Firewall (WAF). Probably the most important thing here. It filters out traffic before it reaches your site and blocks anything malicious. You can GEO block countries that breaches originate from and it acts as a strong barrier to brute force attacks.
• Malware Scanning. Your site is being updated regularly: content, images, funky features. What if malware sneaks in as well? Using a scanner allows you to review the file structure and flag up anything naughty.
• Hidden Logins & MFA. The world is becoming more security centric. But it has a way to go before it’s security focused. Hiding login pages on different URLs and forcing Multi Factor Authentication is a no-brainer. 

There are, of course, plenty of other mechanisms to put in place. We offer a security measure that is robust, evolving and reduces risk on websites, small or large. 

If you’re a customer of ours then you’re in safe hands, if you aren’t then perhaps a few questions below might be worth considering:

• Do you know where your website is hosted and how to contact the host? 
• Do you currently know whether the site is being maintained at all? 
• Is your site backed up regularly or have you got a copy stored somewhere? 
• Do you have a login to your site and when was the last time you audited the users? 
• If your website went down, how long before you would know it was down?

Of course there are plenty of other questions we could pose. But perhaps that can be done via a call.

This vulnerability, like the rest of them, will fade away from the headlines soon enough. To our colleagues in the industry, we hope the coffee got you through last week and you can breathe a sigh of relief. New vulnerabilities are found all the time, just ask our Dev Team. The businesses that come through them are the ones that have the basics in place already. 

Maintenance, security and managed hosting aren’t the most exciting parts of having a website. Done well, you barely notice them at all. But they’re what let you get on with running your business without worrying about what’s happening under the bonnet.

If you’d like a second opinion on how your website is set up, or you’re not sure whether it’s being properly looked after, we’re happy to take a look. No hard sell, just an honest view of where things stand and what, if anything, needs attention.

You can find out more about our website maintenance, website security and hosting and domains services, or simply get in touch with the team.