Last night a security researcher posted two holes in PHP, the language behind WordPress and most of the web. He posted them publicly, with working attack code, before a fix existed. By breakfast, people online were shutting servers down rather than wait. The official patch did not exist until ten o'clock this morning, Eastern.
A few days earlier, a certificate authority in India admitted that eight of its signing keys were so weak a laptop could recover them in seconds. Those keys vouched for websites. Firefox, Chrome, Apple and Microsoft all pulled them within days. If certificate authority means nothing to you, that is fine. It is the padlock in your browser. Somebody had a master key to a batch of padlocks.
The two stories share one problem, and it is the reason you are hearing about them from us instead of in a hosting newsletter next month.
Neither one fixes itself.
A hole in PHP gets closed when somebody updates PHP on the server your website lives on. Not you, the person who logs in to change the hours on the contact page. Somebody with the keys to the machine. If your site is on a four dollar a month plan, that somebody is a hosting company with a few hundred thousand customers and a ticket queue. If your site was built in 2019 by a guy who has since moved to Florida, that somebody is nobody. The site is up. It looks fine. Nothing is ever going to upgrade it.
That describes a frightening share of the internet. Contractors, restaurants, dentists, churches. Sites that work, that nobody maintains, and that now have a publicly documented way in. The attackers do not need to find them one at a time. They scan.
We saw the PHP disclosure a little after nine this morning. By 9:31 Eastern, with the official patch still half an hour away, our own servers were already blocking the kind of request the attack rides in on, so the vulnerable code never sees it, and the feature the attack goes through was switched off. Two minutes later a watcher was in place to check for the official fix every fifteen minutes and install it the moment it lands. Not a reminder on a calendar. A script that runs 96 times a day. By mid-morning the same feature was switched off on every server we manage.
For the certificate problem we updated the trust lists on every machine we operate and tested each one against a known bad certificate. Every machine refused it. The sites we host use a different certificate authority anyway, so no client padlock ever depended on the eight bad keys.
Three security advisories landed in the last four days, counting one for the software behind several of our web applications. All three were handled the day they were published. None of our clients had to ask. Most of them will read about it here for the first time, which is how it should be.
This morning was loud, but the work is the same every week. We ask every site we host for its home page every five minutes, all month, so an outage is measured in minutes, not in the time it takes a customer to call you. Files and databases are backed up daily and stored off-site. Before any software update touches a site, we take a fresh backup, and if the update breaks anything we put the previous version back within minutes and investigate before trying again. Site files are scanned every day for malware and for changes nobody authorized. Security fixes go on the day they are released. Server software stays on supported versions, which is the whole reason last night's PHP story is a story about other people's websites.
None of this makes the news. It is Tuesday afternoon work. It is also the entire difference between a website that is managed and a website that is merely hosted. Server space is a commodity. Somebody watching the server is not.
Who updates the software your website runs on? If you cannot answer that in one sentence, you have your answer, and so does everyone scanning for sites like yours since last night.
Ask your host. Or send us your domain and we will tell you, free, whether your site is exposed. No sales call, no account to create. If it is fine, we will say so.
Related reading: what managed hosting covers, how software updates and automatic backups work together, and why server space is not a service. We work with businesses across Wilmington, Dover, Milford, and beyond.
Send us your domain and we will tell you, free, whether your site is exposed. No sales call, no account to create. If it is fine, we will say so.
Check my website
