Why so many websites went dark this week
If you tried to visit certain websites on Wednesday, October 21, and got a maintenance page instead, you weren't alone. In the Netherlands, the national login system DigiD, the government portal MijnOverheid, and even the Dutch cybersecurity agency's own site were taken offline for hours. Government services in Finland, France and Australia did the same. The organization behind Wikipedia took some of its systems down too.
Nobody hacked them. Their owners shut them down — on purpose.
What happened
Researchers found two serious flaws in PHP, the software that runs underneath a huge share of the world's websites, including every site built on WordPress. The flaws — nicknamed PHP2Shell — let an attacker run their own code on a server without logging in. They were rated 9.2 out of 10 for severity.
Details leaked online on October 20, a day before the fix was ready. The people who maintain PHP released updates on the 21st, and in between, a lot of organizations decided a few hours offline beat a few hours exposed. Early attacks have since been reported.
So far, so handled — if your site is current.
The catch
The fix only exists for PHP versions that are still supported: 8.2 and newer. PHP 8.1 and anything older no longer gets regular security updates from the PHP project. Some hosting companies patch older versions themselves. Many don't.
That isn't a small corner of the internet. As of the day of the fix, about 27% of websites that use PHP were still running version 7, and nearly 8% were on version 5. For those sites, the only real fix is moving to a current version — which can break an older site that was never built to handle it — or rebuilding on something that doesn't carry the problem.
One more thing that trips people up: updating WordPress, or clicking "update" on your plugins, is not the same as updating PHP. PHP lives on the server, below WordPress. Your WordPress dashboard can be all green while the software underneath it is years out of date.
Why small business sites are the ones exposed
Most small business websites were built once and then left alone. The owner doesn't know what version of anything it runs. The person who built it may have moved on. The hosting bill gets paid every year, and the site sits there looking fine while the software underneath it quietly ages out. Days like this one are when that gap shows up.
What does an out-of-date site actually risk? Usually nothing dramatic at first. The common version is quieter: the site starts sending visitors somewhere else, or Google flags it with a warning that scares searchers off, or the hosting company suspends it. The owner tends to find out last — usually after the phone has been quiet for a while and they can't figure out why.
That isn't hypothetical. In the last few months I've come across local business sites here in St. Charles County that were sending visitors to gambling pages, and others showing "Account Suspended" to anyone who clicked.
Three questions to ask whoever looks after your site
- What does my site run on, and is that version still getting security updates? If it's PHP, the answer you want is 8.2 or newer.
- Who is responsible for keeping it updated, and when was the last update? "The hosting company" is only a real answer if the hosting company says so.
- If the answer to either of those is a shrug, what's the plan?
If you built the site yourself on a hosted builder like Squarespace or Wix, this one isn't on you — those companies manage the software underneath. If you have a WordPress site, or a site someone built for you years ago, it's worth the five-minute conversation.
Where I stand
The sites I build at Dot Grid OS don't run on PHP at all, so this particular flaw doesn't exist on them. Updates and monitoring are part of the service — I check every day that each site is up — rather than something left for the owner to remember.
That doesn't make PHP bad or WordPress a mistake. A WordPress site on a current version, with a host that applied the fix on Wednesday, came through this fine. The difference wasn't the software. It was whether anybody was looking after it.