We’re pleased to confirm that we have now closed this incident, having experienced no security breaches, service disruptions, or issues affecting any of our clients’ websites. While the incident is closed from our perspective, we will continue to monitor our servers closely for any signs of further problems. You can review the full timeline of events and the actions we took in our live incident log.
Background on the problem
Two serious security flaws in PHP were made public on Wednesday 21 October. Since then, hosting providers, developers and security teams around the world have been patching their servers.
PHP runs millions of websites, including every WordPress and WooCommerce site. That includes many of the sites we build and host.
Our team started work on Wednesday afternoon and carried on through the night. This update explains what we found and what you need to do. For most of our customers, the answer is nothing.
What happened?
The two vulnerabilities affect PHP itself, so they aren’t tied to any one website or hosting company. On servers without the right protection, attackers can use them to take control of a website.
Because so many hosts run PHP, fixing the problem needs action across the whole industry.
What our hosting partner has done
Our hosting partner started emergency maintenance on Wednesday afternoon and expected to finish patching by 09:00 UTC on Thursday 22 October.
Sites that use Cloudflare get an extra layer of protection, because Cloudflare filters out malicious traffic before it reaches the server. We don’t rely on any single measure on its own.
What we’ve done
Alongside our hosting partner’s work, we went through our own server logs looking for signs of attack.
We found no evidence that any website hosted by Courageous has been compromised. We haven’t needed to take any customer sites offline.
Our checks also turned up some unrelated security problems on sites where we don’t manage the ongoing maintenance. We’ve already fixed many of these free of charge and contacted the owners.
We’re running a further security audit today, Thursday 22 October, and will keep monitoring for the rest of the week.
Why ongoing maintenance matters
Keeping a website secure depends on several things working together: well-maintained hosting, regular software updates, strong logins, security monitoring, malware scanning and tested backups.
Even a well-maintained site can be exposed when a flaw turns up in software that millions of sites share, as happened with PHP this week. What matters then is how quickly someone spots the problem and acts on it.
What happens next?
We’re finishing our security checks and will keep watching for any new activity.
We’re also looking at ways to improve malware protection for our hosting customers. We’ll share our recommendations once things have settled.
Do you need to do anything?
If Courageous hosts and maintains your website, you don’t need to do anything. We’ll contact you directly if anything needs your attention.
If your website is hosted elsewhere, ask your hosting provider what they’ve done to protect your site and whether you need to take any action.
The BBC is covering the story here:
If you have any questions, please get in touch with the team.
The Courageous Team
Incident Closed: October 26th, 08:57
After a final check through all sites, we are pleased to bring an end to the need for any further action.
Update: October 23rd, 06:20
We’ve checked the firewall logs on every server that hosts our customers’ websites, going back to the start of the incident, and we still have no evidence that any website we host has been compromised. On the evening of 22 October, our firewall blocked one attempt to exploit the PHP flaws.
By then, the server had already been patched, and we found no sign that the attempt had any effect. Our hosting partner finished patching all its servers on 22 October and is still monitoring. We’ll keep watching our servers closely and will post any further updates here.
Update: October 22nd, 13:03
All of our sites look to be fine, and monitoring will continue through the day. It is likely we will hold off on an email update unless it is critical and give a final debrief tomorrow.
Update: October 22nd, 11:19
Our hosting partner, Cloudways, has confirmed that the PHP security patches have been rolled out to all of its active servers, including the servers that host our customers’ websites. Cloudways is contacting a small number of customers whose setups need extra help, and if any of our servers fall into that group, we’ll deal with it directly. We’ll run another scan later today to confirm everything is still clear. If you have any questions, please get in touch with our team.
Update: October 22nd, 11:11
We ran a fresh scan of all the websites we host this morning and found no sign that any have been affected by the PHP vulnerabilities. Our firewall has blocked no attacks linked to the PHP flaws. We’ll run another scan later today. Our hosting partner is still rolling out patches across its servers, and we expect an update on the status of all our servers within the next couple of hours.
