Update: October 22nd, 13:03
All of our sites look to be fine, and monitoring will continue through the day. It is likely we will hold off on an email update unless it is critical and give a final debrief tomorrow.
Update: October 22nd, 11:19
Our hosting partner, Cloudways, has confirmed that the PHP security patches have been rolled out to all of its active servers, including the servers that host our customers’ websites. Cloudways is contacting a small number of customers whose setups need extra help, and if any of our servers fall into that group, we’ll deal with it directly. We’ll run another scan later today to confirm everything is still clear. If you have any questions, please get in touch with our team.
Update: October 22nd, 11:11
We ran a fresh scan of all the websites we host this morning and found no sign that any have been affected by the PHP vulnerabilities. Our firewall has blocked no attacks linked to the PHP flaws. We’ll run another scan later today. Our hosting partner is still rolling out patches across its servers, and we expect an update on the status of all our servers within the next couple of hours.
Background on the problem
Two serious security flaws in PHP were made public on Wednesday 21 October. Since then, hosting providers, developers and security teams around the world have been patching their servers.
PHP runs millions of websites, including every WordPress and WooCommerce site. That includes many of the sites we build and host.
Our team started work on Wednesday afternoon and carried on through the night. This update explains what we found and what you need to do. For most of our customers, the answer is nothing.
What happened?
The two vulnerabilities affect PHP itself, so they aren’t tied to any one website or hosting company. On servers without the right protection, attackers can use them to take control of a website.
Because so many hosts run PHP, fixing the problem needs action across the whole industry.
What our hosting partner has done
Our hosting partner started emergency maintenance on Wednesday afternoon and expected to finish patching by 09:00 UTC on Thursday 22 October.
Sites that use Cloudflare get an extra layer of protection, because Cloudflare filters out malicious traffic before it reaches the server. We don’t rely on any single measure on its own.
What we’ve done
Alongside our hosting partner’s work, we went through our own server logs looking for signs of attack.
We found no evidence that any website hosted by Courageous has been compromised. We haven’t needed to take any customer sites offline.
Our checks also turned up some unrelated security problems on sites where we don’t manage the ongoing maintenance. We’ve already fixed many of these free of charge and contacted the owners.
We’re running a further security audit today, Thursday 22 October, and will keep monitoring for the rest of the week.
Why ongoing maintenance matters
Keeping a website secure depends on several things working together: well-maintained hosting, regular software updates, strong logins, security monitoring, malware scanning and tested backups.
Even a well-maintained site can be exposed when a flaw turns up in software that millions of sites share, as happened with PHP this week. What matters then is how quickly someone spots the problem and acts on it.
What happens next?
We’re finishing our security checks and will keep watching for any new activity.
We’re also looking at ways to improve malware protection for our hosting customers. We’ll share our recommendations once things have settled.
Do you need to do anything?
If Courageous hosts and maintains your website, you don’t need to do anything. We’ll contact you directly if anything needs your attention.
If your website is hosted elsewhere, ask your hosting provider what they’ve done to protect your site and whether you need to take any action.
The BBC is covering the story here:
If you have any questions, please get in touch with the team.
The Courageous Team
