PHP critical vulnerability - an update from us

You will have seen and heard on the news about the current critical security vulnerabilities with the PHP development language that is used globally for many website platforms.

We want to reassure you that your website hosted by us is not affected by this vulnerability as PHP is not used in our website CMS or hosting environment.

This critical PHP vulnerability, which has been known since 2024, was considered too complex for humans to exploit.

According to BBC reporters, AI was used by researchers to look for as yet undiscovered flaws and they found this particular vulnerability which could allow bad actors access to entire file systems on a server by triggering a certain condition that would allow unauthenticated remote code execution. Read more here.

The PHP foundation were aware of this vulnerability and had produced a patch which was due to be released at the end of October, but information about it was leaked and hackers started probing for this weakness which has caused the huge rush for companies and organisations worldwide to apply patches or workarounds to mitigate it.

PHP runs millions of website platforms worldwide, such as Wordpress, Joomla, Drupal plus many more, all of which will potentially have been affected. This is not just business websites but government and local councils will also have been rushing to mitigate this.

At Purple we take these things very seriously and we continue to implement safeguards and procedures so that we can act as required in the event of something that may affect you and your business. Fortunately, if your website is hosted by us, you are not affected by this vulnerability.