Critical PHP security vulnerability: patches and firewall protection rolled out
On 21 October, a critical security vulnerability was disclosed in PHP, the software that runs most websites, including WordPress. If left unpatched, it could allow an attacker to run malicious code on a server without needing to log in. It affects a very wide range of PHP versions, so website owners and hosts around the world are applying updates.
What we've done
- Rolled out the security patches to websites where the site's software is compatible with the updated PHP version.
- Deployed additional firewall rules across our hosting to block attempts to exploit the vulnerability while updates are completed.
- Started close monitoring of all hosted sites for unusual activity.
** At 11:40AM: 8.4.27 was deployed to compatible servers completing the patch.
Our larger-scale public sector clients are protected by deployed Cloudflare Enterprise rulesets.
If a site isn't compatible with the patched PHP version, protections are in place by deployed firewall rules. We'll contact those clients directly.
You do not need to take any action. Security updates are deployed automatically across our platform. If we need anything from you, we'll be in touch directly.