Blog · Website
Vulnerabilities will always come. What matters is how long they stay open.
2 min read
On October 21, two critical security flaws were disclosed in PHP. PHP runs on 69 percent of websites whose server-side language is known, WordPress sites included. The flaws let an attacker run code on the server with a single request, without logging in. The US cybersecurity agency CISA urged organizations to patch immediately.
This post isn’t about the technical details. It’s about how a website should be set up and maintained, given that new flaws appear every year.
Flaws are normal.
Every piece of software has flaws. PHP and WordPress both release security updates regularly. The real risk isn’t the flaw itself. It’s the time between a patch being released and your site being patched.
That time is shrinking.
Mandiant, Google’s security unit, measured the average time from a flaw’s disclosure to its use in attacks: 63 days in 2018–2019, five days in 2023. This time it was even faster. Amazon’s honeypots recorded an exploitation attempt four days before the flaws were disclosed.
The researchers who studied the flaws say AI played a part: turning a long-standing bug into a working attack is now much easier. The same tools speed up defenders too. But only if someone is actually doing the work.
How should a system be set up?
- Supported versions. Versions past end of life (PHP 8.1 and earlier) got no new release for this flaw. A site on an old version has no options when the next flaw comes.
- Fewer parts. Every plugin, theme and add-on is a door that needs upkeep. What isn’t used gets removed.
- A shield in front. A firewall in front of the site doesn’t replace a patch, but it buys time. Cloudflare released rules for this flaw to all customers, free plans included.
- Backups and rollback. If an update breaks something, you can go back within minutes.
How should it be maintained?
- Watching. Someone regularly reads the security notices for the software you use.
- Speed by priority. Not every update is equally urgent. Critical ones go in within hours; the rest on a schedule.
- Ownership. “Who looks after the site?” has a single answer. A site nobody maintains after launch is the biggest risk.
Where to start?
Look at your own site:
- Which PHP version does your site run on?
- When was it last updated?
- When a flaw is disclosed, who follows it for you?
If the answers aren’t clear, let’s talk. We start with a short intro call.