What's happened?
A huge number of websites run on something called PHP. It's the behind-the-scenes technology that powers lots of websites, including most WordPress & Laravel sites. Most people never see it, but it does a lot of the heavy lifting whenever someone visits a page or fills in a form.
Two serious security flaws were found in PHP itself. In the wrong hands, they could let someone take control of the server a website runs on, without needing to log in. That's why the people who look after PHP treated it as urgent and released a fix today.
The important bit: because the problem is in PHP itself, it doesn't matter how a website was built or how up to date its plugins are. If a site runs on PHP, PHP needs updating.
What we're doing
We're in the process of updating PHP on all of our servers.
Our team is working through every server we look after and installing the fix carefully. We then check that each website is running the updated, secure version. Keeping our clients' websites secure is part of what we do every day, and this is exactly the kind of thing our processes are built for.
You might notice a few seconds' blip on your site while an update goes on. Beyond that, it should be business as usual.
If you're an Element Seven client
You don't need to do anything. We've got it in hand. If anything about your website needs a conversation, we'll get in touch with you directly.
If your website is hosted somewhere else
If someone else hosts or looks after your website, it's worth a quick message to ask them one simple question:
"Has PHP on our website's server been updated today with the latest security fix?"
A good hosting provider or developer will know exactly what you mean and should be able to give you a straight answer. If you don't get one, or you're not sure who looks after your site, get in touch and we'll check it for you.
No need to panic
Security issues like this come up from time to time across the whole web. What matters is how quickly and carefully they're dealt with. The fix is already out, it's well understood, and applying it properly sorts the problem.
Here to help
Whether you're an existing client or just want peace of mind about your website, we're always happy to chat. Our team works with websites like yours every day, and we'd be glad to take a look.
Get in touch with Element Seven
For your developer: the official details are in the PHP security advisory, with practical update guidance from Laravel Forge and Laravel News.
