The PHP Foundation released critical security updates Wednesday for its PHP scripting language. These updates, according to the release notes, "fix two critical vulnerabilities that can allow unauthenticated remote code execution." The PHP Foundation recommends that web servers with PHP running on them update to the latest version as soon as possible.
What does this mean for nonprofits? Is this something you have to worry about?
The short version is this: If your site runs on a popular content management system like WordPress or Wix and a website host like GoDaddy, you may not have to take any action; if you operate and manage your own servers, though, the PHP Foundation recommends you apply their patches immediately. (Disclosure: Wix is a TechSoup partner.)
What Is PHP?
PHP is a programming language, used on almost 70 percent of websites, that lets you build lightweight applications and other functions into your site. For example, many publishing platforms, such as WordPress, Drupal, and ExpressionEngine, are built with PHP.
PHP is pretty common, and there's a high likelihood that your web host supports it, even if you aren't actually using it on your website.
What Do These Security Flaws Mean?
Since PHP is a programming language, it allows for a wide range of capabilities. And like all programming languages, it could potentially be used for nefarious purposes.
These particular patches fix two security vulnerabilities that allow for "unauthorized remote code execution" — that is, a cybercriminal could gain access to a remote server without logging in and exploit the vulnerabilities to run any PHP application on it, including malicious ones.
These vulnerabilities are rated "critical," which is generally used to describe the most severe security flaws. (If you want to get into the nitty-gritty of vulnerability terminology, this post from VMware is worth checking out.)
Do I Need to Do Anything About This?
Administrators with sites that use managed hosting won't have to do anything. These flaws exist within the language that tools like WordPress and Drupal use, not the platforms themselves. The PHP libraries exist on the web server, so it's the responsibility of whoever manages that to apply these patches.
Put another way: If you are paying someone else to be your web host — whether that's a service like GoDaddy or DreamHost or a complete website solution like Wix or Squarespace — then they are the ones who need to apply these updates. On the other hand, if you have an IT team that manages your web servers directly, then your IT team likely will need to apply these fixes.
Still, it's a good idea to check. In its update, the team at WordPress says, "Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to mitigate the vulnerabilities, but you should still check for updates from your web host and, if necessary, update PHP as soon as possible."
According to the PHP Foundation, PHP versions 8.1 and earlier are no longer supported. If you run your own web server and use one of these older versions, the WordPress team recommends that you take your site offline and work to upgrade to a supported version of PHP.
So if you haven't already, check in with your IT and infrastructure team if you have one, or with your web hosting company. But if you manage your own web server, this is not an update that you'll want to skip. And if your website hosts sensitive data such as PII, consider taking it down until a patch is put in place.
A former technology journalist, Nick is the editor of the TechSoup Blog.
Thumbnail photo: Shutterstock
