PHP2Shell: why managed services matter more than ever in the age of AI

IntroductionIntroduction

On Tuesday evening, two critical vulnerabilities in PHP came to light, putting millions of websites, from WordPress to Drupal, at risk. A fix was announced for Wednesday at 4 p.m. But by mid-morning, hours before that fix, the first attacks were already being reported.

We asked Roy Meister, who leads Digital Continuity Services (DCS) at Hypersolid, what happened, how his teams handled it, and why a day like this shows what that work is really worth.

InterviewInterview

Q: What happened?

One of our colleagues shared the announcement in our security channel right away. At that point, we knew only two things: a patch would follow the next afternoon, and the score was right at the top of the 0-to-10 scale, which basically means it can't get any worse. These are the kind of flaws that give access to systems in a rather simple way. And PHP is literally used to generate web pages, so it sits right where the internet can reach it.

By the end of Wednesday morning, security firms were reporting that the flaws were already being exploited. At that point, nobody knew exactly what the flaws were. But that was enough for us to act.

Q: How did your teams approach it?

The first thing we did was map where our clients were exposed. We manage all the systems we run from one central configuration platform, so we could quickly see where PHP was installed and which versions were running. It doesn't even have to be in use; if it's on a server, it could be a risk.

On Wednesday morning, we informed every affected client with a message tailored to their situation: there's a risk, the patch is coming at 4 p.m., and we'll apply it for you right away. When the first reports of abuse came in, we contacted them again and strongly advised taking their websites offline. That's a business decision, and it's not ours to make. But many clients acted quickly, and you saw sites going offline across the web.

The patch came out just before 4 p.m. We tested it on a few test environments, rolled it out, and by about 5 p.m. practically every site was back online. A few applications needed some extra care, because restarting an application sometimes takes more effort than restarting a server, so we stayed on those until they ran properly.

Then there were the clients who run their own containers. In a container, the developer packages their own libraries and versions. That's exactly the strength of it, but it also means we can't fix it for them. For us, it's a closed box: they deliver it, we run it. So we told those clients exactly what to do: rebuild your containers and deploy again. Several didn't even know they were exposed, and after our email they got their development agencies working on it the same day. Where they needed our help in production, we kept going until 1 a.m. to get everyone safe.

By the end of the day, several clients had emailed to thank us for how we handled it. And it isn't over. There are already reports that the patch may not cover everything, so we're keeping a close eye on it.

Q: So what's the value of managed services in a moment like this?

Implementing a patch isn't rocket science; it took only 30 to 45 minutes. What clients pay for is everything around it: a team that knows their systems, is watching before they call, and acts at 4 p.m., not hours later when a nightly automatic update happens to run. And people who can make the call to go offline when there's no fix yet. Automation can't do that.

It also matters who the message comes from. For every client, this came from a familiar face, not an anonymous alert that makes you wonder whether it's real. With some clients you pick up the phone, with others it's an email, but they all recognize how we communicate. If there are questions, clients can go where they always go: a ticket, our support teams or their account manager.

That's only getting more important. We used to see a vulnerability this serious, like Heartbleed or Log4Shell, every two or three years. Now AI is finding flaws much faster. Researchers used AI to dig into this one. More and more code is being written with AI. More code means more flaws, and more days like this one.

What you can control is how exposed you are. We shield all our management ports from the internet at all times, so if a flaw turns up in a management system, we fix it quickly, but nobody on the other side of the world can just walk in. PHP is a different story. It's used to generate web pages, so it's intended to be exposed. With a score like this, there's no waiting. You act immediately.

That's what our Digital Continuity Services are for: always-on monitoring, incident management and recovery, security and compliance, and performance, capacity and patching. Curious how ready you'd be for the next one? Let's talk.