Your Website Is Your Responsibility, and Someone Else’s Safety Depends on It
Setting up SPF, DKIM, and DMARC is less a technical chore than a promise to your customers. You make sure the providers behind your email do their part. That way a criminal cannot send a convincing message in your name. The people who trust you do not pay the price. The PHP vulnerability disclosed in October is a second place to keep that same promise.
What This PHP Vulnerability Means for Websites
On October 21, the team that maintains PHP released emergency fixes for two serious flaws. PHP is the programming language behind a large share of the web, including WordPress. Your website may well depend on it. Both flaws can let an attacker run commands on a web server without a password. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive regular updates from the project, so those sites depend on a vendor’s backport or an upgrade.
This PHP vulnerability could have remained a story for the technology press, but it did not. Attackers began probing before the fixes existed. Amazon’s threat researchers reported the first attempts on October 17, four days before the patches arrived. On October 26, the federal Cybersecurity and Infrastructure Security Agency listed both flaws as actively exploited. It gave federal civilian agencies until October 29 to fix them. Researchers have since recorded working attacks against a decoy server built to look vulnerable.
Five Minutes and Three Questions for Your Web Host
Your customers cannot check whether your web host has applied a fix, which leaves the responsibility with you. Asking takes about five minutes. Send your host or web developer three questions in writing. Has your team updated our site to a fixed version of PHP, or protected it some other way? When did that happen? Before it did, did anyone check the site for tampering and for exposed passwords?
Ask for confirmation rather than a version number alone, because some providers repair a flaw without changing the number. An attacker who can run commands on a server can often reach what it holds in memory. That can include passwords and keys, so ask whether you should change the ones your site uses.
A patch closes the door, but it does not tell you whether someone walked through first. Because the attempts against this PHP vulnerability began before the fixes existed, the third question matters most. Checking for tampering is real work. Someone has to examine the server’s records and compare what changed against who was supposed to change it. Your host or developer should do that review, and you should expect a straight answer about whether it happened. A vague reply is a warning, and so is silence.
Patching is also a permanent obligation. This will not be the last flaw of its kind. Ask how your host learns about the next one and how quickly it acts.
How to Protect Yourself From a Compromised Site
You are also someone else’s customer, so consider the other side of the counter. Most of us assume that the padlock beside a web address means a site is safe. The padlock means only that the site encrypts the connection between you and it. A compromised page can still display a fake login box or a card form that sends your details to a criminal. You cannot reliably tell by looking.
Because you cannot inspect a site for compromise, the sensible goal is to limit what a compromise costs you. Pay with a credit card instead of a debit card. A disputed credit charge puts the bank’s money at stake, and a disputed debit charge puts your own. Use Apple Pay, Google Pay, or PayPal when a site offers them. They generally keep your real card number away from the merchant. Give every site its own password, which a password manager makes painless. Then one stolen password opens only one door. Turn on multi-factor authentication wherever a site offers it. Switch on transaction alerts so your bank tells you about a charge as it happens.
I am not suggesting that you stop shopping online, or that attackers have compromised every site you visit. I am suggesting that the people who run websites owe their customers a few minutes of diligence. The same few minutes protect you when you are the customer. If you ask your host and the answer troubles you, send me a message and tell me what you heard.
Until next time, keep IT simple.
Dave
