A critical PHP flaw hit the web this week. Here is how we responded.

On October 21, PHP released emergency fixes for two major flaws known as PHP2Shell. These issues affect the PHP software itself, not just platforms like WordPress or Drupal. Updating your CMS or plugins won't solve the problem. The server must update PHP to fix it.

Layer one: protection at the edge

Cloudflare created firewall rules for these flaws before PHP released its fixes. These protections went live at 3:02 am UTC on October 21. If your site uses Cloudflare, you were protected automatically, whether you have the free or paid firewall. Cloudflare noticed attack attempts and saw attackers try new methods to bypass the rules. It continues to update the rules as new tactics appear.

If your site runs behind Cloudflare, you had a protective layer in place before PHP shipped a fix. Free plans needed no action.

Layer two: hosting platforms patched PHP

• Pantheon set up network-level protections and made configuration changes before applying patches. On October 21, it updated all live production sites running supported PHP versions (8.2 to 8.5). Pantheon patched sites using older PHP versions were through its long-term support vendor. Pantheon found no signs of compromise. Its protections blocked more than 60,000 suspicious requests that day.
• Upsun put protections in place for every PHP application before the fix was released. Now, it automatically redeploys sites with the updated PHP version. No code changes are needed.

Layer three: your agency

We began working before PHP released its fixes at 10 am Eastern. We checked the PHP versions on every site we host and monitored each vendor's updates. Our own applications, including our support system, switched to the fixed PHP version that same day.

Why more than one layer

No single control catches everything. Cloudflare recommends patching PHP even with its rules on. Pantheon and Upsun both ran network-level protections while patches rolled out. Layers fill the gaps. We use this setup for every site we support.

Cloudflare also controls AI bot traffic

The same protection that blocked this week's attacks also manages automated traffic from AI companies. Several clients have asked us about unexplained traffic from locations they don't serve. Some of this traffic is from AI crawlers gathering content to train their models.

Cloudflare's AI bot controls sort crawlers into three groups: search, training, and agents that act for a user. You decide what happens to each group. Most sites allow search crawlers, which send visitors your way, and block training crawlers, which collect your content without sending anyone back. These controls come with Cloudflare's free plan. Crawlers that do both, like Googlebot, follow the strictest rule you set. A training block also blocks search. We set these rules with you, not for you.

What you need to do

If your site is on Pantheon, no action is needed. If your site runs an older PHP version, upgrade now. PHP 8.1 and older no longer get regular updates. If your site isn't behind Cloudflare, talk to us. Cloudflare's protection was live before PHP released its fixes. If you manage your own Cloudflare account on a paid plan, make sure the managed ruleset is in block mode. Free plans need no action.

If you have questions about your site, let’s set aside some time to chat, and together, we’ll figure out a practical approach.