Start a chat.
Call us.
WhatsApp us.
Create a ticket.
Two serious security vulnerabilities have been discovered in PHP, the programming language on which WordPress also runs. Early this morning, a dedicated internal team at Webtify was on standby with a single mission: to protect our clients’ websites and online stores.
In this blog post, I want to tell you exactly what's going on, what we've already done, and what's coming up this afternoon.
-- There will be no more updates --
<g id="gid_0">12:00 update: There are reports circulating in the news that another “major” bug has been found in PHP and that the patch released yesterday is incomplete. We would like to confirm that this is absolutely <g id="gid_1">not</g> on the same scale and is primarily scaremongering by the media. You don’t need to worry about this. </g>
00:15 update: Final check of our provider's email features. Everything is working as it should.
5:15 p.m. update: Email services are back online.
12:00 update: There are reports circulating in the news that another “major” bug has been found in PHP and that the patch released yesterday is incomplete. We would like to confirm that this is absolutely not on the same scale and is primarily scaremongering by the media. You don’t need to worry about this.
4:00 p.m. update: Frits Corvers, our founder, explains today's PHP vulnerability in a video on LinkedIn and Instagram.
9:45 a.m. update: Our email functionality is still not working properly due to issues with our provider. We are working very hard to ensure that it is back up and running as soon as possible.
<g id="gid_0">4:00 p.m. update: Frits Corvers, our founder, explains today's PHP vulnerability in a video on LinkedIn and Instagram. </g>
11:00 p.m. update: The email service is still not 100% functional. We are still receiving several reports that it is not working properly for everyone. Unfortunately, this issue is on our supplier’s end.
4:00 p.m. update: Frits Corvers, our founder, explains today's PHP vulnerability in a video on LinkedIn and Instagram.
4:15 p.m. update: Due to the restart of several servers, a number of websites are currently unavailable. We'll keep you updated.
4:03 p.m. update: No data was stolen today. Everything is secure. No websites were taken offline for an extended period of time either.
4:00 p.m. update: Frits Corvers, our founder, explains today's PHP vulnerability in a video on LinkedIn and Instagram.
3:58 p.m. update: All servers worldwide have been updated at Webtify.
3:20 p.m. update: It is currently not possible to use Webtify's email service through your browser. It is not yet clear whether email addresses can be used in Outlook or other email servers.
3:15 p.m. update: We’ve noticed that many questions are being raised about why Webtify has chosen not to take websites (worldwide) offline. This is due to our firewall-level measure and the additional security lock we’ve implemented.
3:00 p.m. update: PHP will roll out the update worldwide in one hour. Our team is currently making all the necessary preparations.
2:30 p.m. update: Your website or online store does not need to be taken offline.
1:00 p.m. update: Our support team is working to answer all questions; thank you for your patience.
12:00 p.m. update: Keep an eye on our social media channels for the latest updates.
8:30 a.m. update: All of our servers worldwide have been equipped with the appropriate measures to ensure maximum security.
8:00 a.m. update: We are aware of the breach, and our special team has taken immediate action.
What's going on?
The vulnerabilities are in PHP itself, not in any specific website or plugin. As a result, they affect a huge portion of the internet all at once. Attackers who manage to exploit the vulnerability can remotely execute their own code on a server. In the worst-case scenario, this gives them access to the website and the data it contains.
The impact is visible everywhere today. Major organizations such as DigiD, MijnOverheid, and the House of Representatives have taken their websites offline as a precaution. RTL and several provinces are also experiencing disruptions.
The National Cyber Security Center (NCSC) has not yet observed any active exploitation, but is urging companies to update PHP as soon as possible. The U.S.-based company Cloudflare, which acts as a firewall for many major websites, is already seeing the first attack attempts. In short: this calls for speed. And that’s exactly what we’re set up for.
What we've been doing since this morning
Since early this morning, a dedicated in-house team at Webtify has been working full-time on one thing: ensuring maximum protection for all the websites and online stores we manage. That’s exactly why business owners choose our website subscription service. You run your business; we make sure your website stays secure, fast, and up-to-date. On a quiet day, you hardly notice it. On a day like today, it makes all the difference.
Two specific measures have been implemented
Our server-wide firewall has been updated
All of our websites and online stores are protected by a server-level firewall. This firewall inspects traffic before it reaches your website and blocks suspicious requests.
The vendor of this firewall has already released an update today that specifically addresses these PHP vulnerabilities. This update is designed to completely block attempts to exploit the vulnerability before they even reach your website. We have implemented this update immediately.
The firewall is therefore our first line of defense—like a lock on the front door—while the permanent repairs to the house are still underway.
Temporarily locked for extra security
In addition to the firewall, we take it one step further. At the server level, we temporarily disable a number of options that aren’t necessary for your website or online store to function normally, but that attackers could use as a point of entry.
This is how we minimize the attack surface. The fewer doors that are open, the fewer opportunities there are for an attack. These additional measures are temporary: as soon as the permanent solution has been safely implemented, we’ll restore everything to the way it was.
The final solution will be announced this afternoon at 4:00 p.m.
This afternoon at 4:00 p.m., the organization behind PHP will release a definitive, global solution. Our team is ready to roll it out immediately to all the websites and online stores we manage.
After the rollout, we'll check to make sure everything is working properly and gradually roll back the temporary measures. The lock on the front door will remain, but by then the house itself will have been repaired.
What does this mean for you?
It's very simple—you don't have to do anything yourself. You don't need to install any updates, adjust any settings, or call anyone. We'll take care of that. We'll keep you updated on every new step today through our website and social media. As soon as the final solution is rolled out, we'll let you know right away.
Frits Corvers
Founder & CEO
Webtify
