On October 20, we learned via a Mastodon post and an announcement on the php.net website that fixes for highly critical PHP security vulnerabilities would be released on October 21 at 4:00 p.m. 70% of all websites on the entire internet are written in the PHP programming language, including Drupal and, consequently, virtually all of our client and internal projects. The Federal Cyber Security Hub has also provided information about this security vulnerability.
We contacted our hosting partner, Upsun, early on October 21 to clarify how they were prepared to address this. We received initial confirmation that they had been notified in advance and had implemented safeguards to fend off initial attacks as a temporary measure until the fixes were available. Some of our client projects were additionally protected by the CDN providers Cloudflare and Fastly.
Based on this, we decided that it was justifiable from a security standpoint not to take such protected websites offline. We used the time leading up to the release to deactivate individual projects that did not have the same level of protection. We also informed and supported customers and partners in deactivating their projects as needed until the security updates were available.
In the hours leading up to the release, the first leaks occurred, and according to status updates and blog posts from Upsun and Cloudflare, the first attacks were recorded as attackers attempted to exploit this vulnerability. As it later became known, the release was actually scheduled for October 22, without prior announcement, but was moved up by one day and announced due to these initial leaks. Further adjustments were not possible because this release date had been coordinated with dozens of partners (hosting providers, CDN service providers, operating systems such as Debian/Ubuntu) to ensure that the fixes would be available simultaneously for as many websites as possible upon release.
The fixes were then released on schedule, after which Upsun, along with countless other service providers, immediately set about deploying the updates to all projects; this happened automatically and required no manual intervention on our part.
We continue to actively monitor the situation, as it is possible that additional similar security vulnerabilities may come to light in the near future against which the current protection is not yet sufficient.
In closing, we would like to specifically draw attention to the PHP Foundation’s blog post, which explains how these security vulnerabilities were identified and resolved and, in particular, how important it is that organizations bearing such an incredible responsibility receive adequate funding:
Today’s PHP Security Release, and How We’re Strengthening PHP Security
