Summary
Two critical security vulnerabilities, nicknamed “PHP2Shell,” were recently disclosed in PHP, the programming language that powers WordPress and most other website platforms. PHP has released a security update to fix them.
If we host your website, you don’t need to take any action. Your site was protected right away, and the official fix is being applied for you.
If we host your website, you don’t need to take any action. Your site was protected right away, and the official fix is being applied for you.
Is WordPress the problem?
No. These vulnerabilities are in PHP itself, not in WordPress or any plugin. Some reports mention a demonstration on a WordPress site, but that only reflects how common WordPress is. Updating WordPress or plugins doesn’t fix this. Updating PHP does, and we’re handling that for you.
What we’ve done
- Immediate protection. As soon as the vulnerabilities were announced, our hosting partner put a server-level safeguard on every site we host, including staging sites. It blocks the reported attack method, so sites are protected while the official fix rolls out.
- The official fix. Our hosting partner is applying PHP’s security update automatically across all the sites we host.
- Verification. We’re confirming PHP versions across the sites we host as the update rolls out.
An extra layer of protection: Cloudflare
Every website we host runs behind Cloudflare’s Web Application Firewall (WAF), which filters traffic before it ever reaches your site. Cloudflare helped coordinate the response to this vulnerability with the PHP Foundation and security researchers, and rolled out protections ahead of the public announcement. Your site was covered automatically, with nothing for you to do.
Cloudflare keeps watching attack activity and updates its rules as new variations show up. You can read more in Cloudflare's announcement.
Cloudflare’s protection works alongside the PHP updates we’re rolling out, not in place of them. Like Cloudflare, we recommend both, and that’s exactly what we’re doing.
Do I need to do anything?
No action is needed for sites we host.
If your website is hosted somewhere else, contact that hosting provider. Ask when they’ll apply the PHP security update and whether they’ve put interim protections in place.
Can my IT team or I update PHP ourselves?
For sites we host, please don't. PHP is managed at the server level by our hosting partner, and the update is already being applied for you. Changing it on your own could break your site or interrupt the protections in place. If your IT team has questions, we're happy to answer them, so just open a ticket.
For sites we host, please don't. PHP is managed at the server level by our hosting partner, and the update is already being applied for you. Changing it on your own could break your site or interrupt the protections in place. If your IT team has questions, we're happy to answer them, so just open a ticket.
My IT provider (or Bullhorn) sent us an alert. What should I tell them?
Many IT providers and software vendors, including Bullhorn, have sent alerts about PHP2Shell, which is a good sign that people are taking it seriously. You can share this article with them. For sites we host, protection is in place through our hosting partner's safeguards and Cloudflare's WAF, and the official PHP update is being applied. If your IT team needs specifics for your site, open a ticket, and we'll confirm the details.
Many IT providers and software vendors, including Bullhorn, have sent alerts about PHP2Shell, which is a good sign that people are taking it seriously. You can share this article with them. For sites we host, protection is in place through our hosting partner's safeguards and Cloudflare's WAF, and the official PHP update is being applied. If your IT team needs specifics for your site, open a ticket, and we'll confirm the details.
I heard Bullhorn took some products offline. Is that related?
Bullhorn took some of its own PHP-based products offline as a precaution. That's a step Bullhorn took for its own systems, and it doesn't change anything about your website. For updates on Bullhorn's products, see Bullhorn's status page or contact Bullhorn Support.
My site runs PHP 8.2. Should I upgrade?
PHP 8.2 receives this fix. However, PHP 8.2 reaches end of life on December 31, 2026, and won’t get security updates after that, so moving to a newer version in the coming weeks is a good idea. Some older plugins and themes may not support newer PHP versions, so we always take a full backup first. Submit a support request and we’ll help you plan the upgrade.
What about sites on older PHP versions?
PHP 8.1 and older no longer receive security fixes from the PHP project, so no official patch is coming for them. The server-level safeguard still protects these sites. If your site is on an older version, our team will reach out to you directly about next steps.
Bullhorn took some of its own PHP-based products offline as a precaution. That's a step Bullhorn took for its own systems, and it doesn't change anything about your website. For updates on Bullhorn's products, see Bullhorn's status page or contact Bullhorn Support.
My site runs PHP 8.2. Should I upgrade?
PHP 8.2 receives this fix. However, PHP 8.2 reaches end of life on December 31, 2026, and won’t get security updates after that, so moving to a newer version in the coming weeks is a good idea. Some older plugins and themes may not support newer PHP versions, so we always take a full backup first. Submit a support request and we’ll help you plan the upgrade.
What about sites on older PHP versions?
PHP 8.1 and older no longer receive security fixes from the PHP project, so no official patch is coming for them. The server-level safeguard still protects these sites. If your site is on an older version, our team will reach out to you directly about next steps.
Does this affect my career portal?
No. Your career portal runs on our career portal platform, which isn’t affected by these PHP vulnerabilities. Job listings and applications continue to work as normal. As an extra precaution, we’re reviewing all of our systems that use PHP, and we’ll update this article if anything changes.
Questions?
We’re always happy to help. Contact our support team by opening a ticket.
No. Your career portal runs on our career portal platform, which isn’t affected by these PHP vulnerabilities. Job listings and applications continue to work as normal. As an extra precaution, we’re reviewing all of our systems that use PHP, and we’ll update this article if anything changes.
Questions?
We’re always happy to help. Contact our support team by opening a ticket.
Comments
0 comments
Article is closed for comments.