A recently identified security vulnerability affecting certain versions of PHP has prompted review and action across the web hosting industry.
As many websites and web applications rely on PHP, vulnerabilities of this nature are taken seriously and assessed as soon as information becomes available.
We wanted to provide an update on the steps taken within Cosmic’s hosting environment and the current status of the issue.
What happened?
A security vulnerability was identified in specific versions of PHP, the server-side software used by many websites and content management systems (such as WordPress, Drupal, and Joomla).
Following publication of the advisory, our hosting and web teams reviewed the potential impact on the systems and websites we manage.
Assessment and initial response
Many of the websites we host were already running newer PHP versions that were not affected by the issue. For websites and platforms where further review was required, additional monitoring and protective measures were put in place while more information became available.
As a precaution, some temporary restrictions were introduced within the hosting environment. In certain cases this affected the ability to upload files or images while the vulnerability was being assessed and mitigation measures were applied.
Although these restrictions caused some inconvenience, they helped reduce potential exposure whilst allowing websites to remain available.
Security patch applied
The official PHP security update has now been released and applied across our hosting platform.
The update was installed overnight in accordance with guidance from the PHP development team and our hosting partners.
Following the successful deployment of the patch, we are reviewing and removing any temporary restrictions that were introduced during the response phase.
Current status
At the time of writing:
- The official security patch has been applied.
- Protective measures introduced during the assessment period remain under review.
- We continue to monitor guidance from PHP maintainers and hosting providers.
- Additional checks are being carried out as part of our standard security procedures.
We are not currently aware of any compromise affecting client websites hosted within our managed environment.
Ongoing monitoring
Security incidents such as this are a reminder that website security requires continual monitoring, maintenance and review.
We will continue to follow any further guidance issued by the PHP development team and hosting providers, and will take any additional action that may be required.
Do clients need to do anything?
Cosmic clients benefit from a managed hosting service. This means that we take care of all the technical updates to your CMS (such as WordPress plugins) and hosting environment for you.
Because of this, no action is required is most of our clients.
Where additional action is needed for a specific website, we will contact affected organisations directly.
If you have any questions about your website or hosting service, please contact the Cosmic web team.