A website is never finished. We say it a lot at Kitty, usually when we’re talking about performance: there’s always another test to run or another improvement to make. But last week was a reminder that it applies to security just as much.
What happened
On Tuesday 20 October, the PHP team warned of two critical vulnerabilities, now known as PHP2Shell. PHP is the language running quietly underneath a huge share of the web, including platforms like WordPress. Both flaws were rated 9.2 out of 10 for severity, and in plain terms they could let an attacker run their own code on a website’s server without ever logging in.
There was no evidence of attack attempts at the time. The real concern was timing. Details of the vulnerabilities became widely known before PHP had released a fix, which left sites exposed and raised the risk of attackers moving quickly. Some organisations took their sites offline rather than risk it.
PHP released the fix on Wednesday 21 October. Within 30 minutes, our development team, working alongside our hosting provider, had patched, updated and protected every actively managed Kitty client website.
Why we moved so fast
Looking after a website doesn’t stop at launch. For the clients we support on an ongoing basis, keeping their sites secure and running smoothly is part of the job, and we’d rather act first than wait to be asked. When a vulnerability like this lands, we’re already watching for the patch, and our developers know every site we look after inside out.
We also don’t rely on patches alone. Kitty has its own security checking tools and procedures that regularly audit our codebases, looking for suspicious files or newly created admin users that may not be legitimate. That means we can spot and deal with weaknesses before they’re exploited, rather than after.
“Moments like this are when retained support really earns its keep, our clients’ sites were protected before most people had finished reading the headlines.”
Rob Knight, Managing Director at Kitty.
Five ways to keep your website secure
- Update PHP to the latest version. It’s the only complete fix for PHP2Shell, and staying current protects you from whatever comes next.
- Keep your CMS and plugins up to date. Outdated plugins remain one of the most common ways in for attackers.
- Review who has admin access. Old users and forgotten logins are open doors. Clear them out regularly, and look out for any accounts you don’t recognise.
- Use strong passwords and two factor authentication. Make getting into your CMS as difficult as possible.
- Have a development partner in your corner. Security isn’t a one off task. A retained partner keeps your site maintained, monitored and patched, so news like this is handled before it becomes a problem.
Not sure where you stand?
Every business comes to us with its own set of challenges, and that’s what we love about what we do. If you’re unsure whether your site is protected, or you’d simply like someone keeping an eye on it, get in touch. We’ll check it over and talk you through it.
