The PHP vulnerabilities caused disruption across the internet today, 21 October. We also took precautions. Utopis remained available, while we temporarily took our WordPress environments offline.
By 5 pm, these environments were back online after we installed the security update. What happened, and why was Utopis unaffected?
Utopis consists of applications built on ASP.NET and .NET Core. Today’s vulnerabilities affected PHP, a different underlying technology. As a result, Utopis was unaffected by these specific issues, and our customers could continue working.
Was that an impressive achievement on our part? No. We’re simply glad Utopis was unaffected. Using different technology does not automatically make an application more secure. Every application needs maintenance, security updates and people who pay attention.
Major websites, including RTL Nieuws, MijnOverheid and Tweakers, were also taken offline as a precaution today. That gives an indication of the scale of the risk.
We use WordPress to manage our own website and the websites we build for customers. WordPress runs on PHP, so we needed to take action there.
We temporarily took these environments offline to limit the risk while waiting for the security update. An inconvenient interruption, particularly if you were about to update your website or visitors were looking for information. At a time like that, security takes priority.
After we installed the new PHP version, the environments were back online by 5 pm. Meanwhile, Utopis remained available for managing and using product information.
The PHP team announced the security update yesterday evening. It became available today. In the meantime, prematurely disclosed information and attempts to exploit the vulnerabilities were already circulating. The PHP Foundation reports that it had not identified working exploit code before the release. The threat nevertheless prompted the team to bring the update forward.
AI plays a dual role in this development. Researchers used AI to investigate the PHP vulnerabilities and help verify fixes. Those same capabilities also make it easier for attackers to understand complex weaknesses and turn them into working attacks.
We welcome the speed at which AI helps us work. That speed also places greater demands on how we maintain the software we rely on. We need to assess risks faster, make decisions sooner and sometimes temporarily take systems offline. For us today, that meant keeping Utopis available while closing the WordPress environments until the update had been installed.
Do you have any questions about the temporary interruption to your website? Please get in touch.
