I
am sure that many of you will have spent a good part of the last week dealing with, or at least reading about, the PHP2Shell vulnerabilities.
Last week’s PHP vulnerability story yet again brought cyber into the headlines around the world, prompting organisations to assess systems, apply updates and, in some cases, temporarily take websites and services offline. While the scale of the issue attracted understandable attention, there are several broader lessons we should look to take from it.
Website outages highlight modern society’s reliance on digital services. Whether we’re shopping, banking, accessing public services or simply communicating with one another, much of daily life now relies on technology being available when we need it – a dependence the public increasingly recognises. No technology is perfect and vulnerabilities will continue to emerge, even in software that has been widely used for many years will be just as vulnerable. Legacy systems have always been difficult to secure, but protecting ageing and end-of-life software is now increasingly urgent. The question is not whether issues will be found – AI is seeing to that – but how quickly organisations can understand and respond to them.
As we now know, two research teams, Calif and Wiz, independently found the flaws in August and worked with the PHP Foundation to develop fixes. AI played an important role in identifying vulnerabilities that had remained hidden for many years. It is such a shame that the vulnerability was leaked as this could have been the good news story that we all needed about AI-assisted identification and patching of a vulnerability.
However, details emerged before the planned disclosure and exploitation attempts quickly followed. The NCSC’s response highlighted the importance of acting quickly when significant vulnerabilities emerge. The unfortunate leak is also a reminder that responsible disclosure, collaboration and professionalism remain essential. We may not be as lucky next time!
Patch, and then check
The NCSC’s priority actions are simple: identify systems running PHP, starting with internet-facing ones, and update them. If you cannot update quickly, apply the PHP Foundation’s temporary mitigations or consider taking the system offline. Patching closes the vulnerability but does not remove an existing compromise, so look for signs that systems were affected before you update.
Many organisations took services offline while they did this. That may have been inconvenient for users, and resulted in disruption to income, but it was the right call.
You cannot protect what you do not know you have
For most organisations, PHP would not have appeared on a risk register or in a board paper. Many of us were probably not aware of how embedded it is within our systems. We now all know that it is inside our legacy applications, third-party platforms, appliances or managed services. This is why the NCSC has asked organisations to watch for updates from suppliers whose products bundle PHP. When a critical vulnerability lands, the first question is always “where do we have this?”, and too many organisations struggle to answer it.
Asset management remains one of the most important foundations of good security, and it extends to the supply chain. Even if your own teams do not manage PHP, your website providers, hosting partners and software suppliers almost certainly do. This is the same thinking behind the government’s Cyber Resilience Pledge: understand who is in your chain, how critical they are to the services you deliver, and how you gain assurance about their resilience. I explored this with our Chair Luke Beeson in July.
Resilience is a societal issue, not just a technical one
We have also become very comfortable with the assumption that digital services will always be there. Cash is now the exception for many people, and payments, communications, healthcare, transport and public services all depend on technology. When systems go down, even briefly, the effect is immediate and widespread.
That does not mean we should expect failure. It means accepting that outages, emergency maintenance windows and disruption are part of a connected world, and that we need to plan for them. Resilience is not about preventing every incident. It is about knowing what you have, understanding your dependencies, preparing for disruption and being in a position to respond well when something goes wrong.
Perfection is unrealistic. The professionals who build, defend and assure our digital world, and who responded so well last week, are why resilience is achievable. I am proud to be part of that community.
