Author: SRAM
The homepage loads, forms arrive and the admin login works. For many businesses, that is enough to conclude that the website is fine.
PHP2Shell is a reminder that normal website operation and secure underlying software are separate issues.
PHP has confirmed two critical vulnerabilities that can allow unauthenticated attackers to execute code remotely, and has released fixes. The Verge's continuing coverage describes websites and services temporarily going offline because of the risk.
Businesses running WordPress or other PHP-based systems need to check the server environment as well. Updating page content, themes or plugins does not necessarily update the PHP version actually running the site.
An emergency upgrade can also expose accumulated compatibility problems involving old plugins, custom features and newer environments. Maintenance postponed over time may then have to be tackled during one incident, putting the business under security and downtime pressure at once.
A website needs ongoing investment after launch. System inventories, update schedules, verified backups and incident response arrangements all influence how quickly business can recover when something goes wrong.
Good maintenance is often invisible in daily use. Discovering gaps during an incident can put enquiries, orders and customer trust at risk.
If another critical vulnerability were announced today, would your company know immediately who should act, or start by asking who actually looks after the website?
Sources: PHP official security updates · The Verge | PHP2Shell coverage; commentary is independent editorial analysis.