On October 21, the PHP team released emergency fixes for two critical security flaws in PHP, the programming language that powers WordPress and most of the websites on the internet. Details of the flaws leaked online a day early, and security experts warned that attackers could use them to take over a web server without needing a password. The situation was serious enough that government cybersecurity agencies in Europe advised taking websites offline if they couldn’t be fixed quickly, and several organizations did exactly that.

Every Web Care website stayed online and protected throughout. Here’s roughly how the day went:

• Around 6:00 AM: We began monitoring the official PHP and server announcements and planning our response.
• Around 8:00 to 9:15 AM: We took fresh backups of every server and every website, so we had a clean restore point no matter what.
• Around 10:20 AM: After the PHP team published its official guidance, we applied the recommended protective setting to every site and confirmed it was active on each one.
• Around 1:15 PM: We installed the patched version of PHP on all of our servers and verified that every site was running the fixed version. We then checked every site for signs of tampering, and everything came back clean.

There is nothing you need to do. Your site is patched, backed up and running normally. If you have any questions, please contact us and we’ll get back to you as quickly as possible.