The PHP vulnerability of 21 October: what it taught us about platform management

From first report to going live in one day

The day started with the announcement that PHP would release an important security update at 4:00 PM. However, details about the vulnerabilities had already leaked earlier. Because of that, the problem was known while the solution was not yet available. Around noon, the news also appeared on the NOS. We immediately started informing clients, while our phones were already ringing as well. Clients wanted to know what this meant for their platform. The honest answer? At that moment, nobody knew yet . Fortunately, our hosting provider Upsun quickly let us know that they would automatically deploy the security updates as soon as they were available. Until then, we let clients choose for themselves whether they wanted to pause their platform as a precaution. By a quarter to three, 29 production platforms were paused. Fifteen platforms deliberately stayed online, because clients chose to do so themselves. Starting early in the evening, Upsun rolled out the updates, version by version. Our DevOps team then checked every platform, brought it back online, and gave the team a heads-up. That team then informed the client. Around ten o'clock in the evening, the last platforms were back online.

What conclusions do we draw from this?

We gave clients the choice themselves. Halfway through the day, we couldn't provide well-founded advice yet, because technical details were missing. So we communicated that honestly. Every client received the same message, stating: “Because technical details are still missing, we cannot properly assess at this time what risk the vulnerabilities pose.” Then we asked if they wanted to pause their platform as a precaution. For platforms with high impact, we also contacted them directly by phone.

Pausing works, but also has consequences. A paused platform is safe, but also temporarily unavailable. For a webshop or client portal, that can mean an immediate loss of revenue. Placing a temporary login in front of the platform was not sufficient for some clients. That's why we are now looking at other options per platform, such as a maintenance page.

Outdated PHP versions pose the greatest risk. Platforms with an up-to-date PHP version could be updated within a few hours. For older versions, that took longer. Is your platform running on PHP 7.3 or older? Then no security update was released at all.

Why we continue to use PHP

PHP powers a large part of the internet. Because of that, security vulnerabilities are discovered quickly and also resolved quickly. Within one day, security updates were available for all current versions, plus custom updates for three legacy versions. That shows the strength of a programming language with a large, active community.

We build our platforms according to strict development guidelines. But building a secure platform is one thing. Keeping it secure requires regular maintenance. That's why we advise every client to arrange four things properly:

• A BIV classification. How important are availability, integrity, and confidentiality for your platform? With this, you map out how important it is that your platform is accessible, data remains accurate, and information is well protected.

• A suitable SLA. Make clear agreements about who does what when something goes wrong and how quickly action must be taken.

• A fixed maintenance interval. Make sure your PHP version and other software components (dependencies) are updated regularly.

• Periodic security checks. Regularly check your platform for security risks, so you discover weak spots before someone else does.

On October 21st, we saw how important this is. Platforms that were well maintained were safely back online the same evening. For platforms with deferred maintenance, extra work was needed and the risk persisted longer.

Well prepared when it counts

A critical security vulnerability isn't a matter of if it happens, but when. The difference isn't in the programming language, but in how well you are prepared. With up-to-date software, clear agreements, and a team that can act quickly, you can prevent or limit many problems.

Curious about where your platform stands? Contact us, and we'll look at your BIV classification and the maintenance of your platform together.

Read more? Digital sovereignty and composable architecture: why flexibility is becoming more important