Protecting our clients from the PHP2Shell vulnerability

Over the last 24 hours, a critical security vulnerability has been identified and patched across PHP—the core programming language powering approximately 70% of the web, including WordPress, Drupal, Laravel and countless software stacks. 

While the technical details are complex, the threat is straightforward: unpatched servers are vulnerable to remote code execution. In practical terms, that means an external attacker could run unauthorised code on infrastructure they do not own. The exploit was considered dangerous enough for the UK’s National Cyber Security Centre (NCSC) to advise organisations to apply updates immediately or temporarily take affected services offline until they were in a position to update. 

We treat security threats with the urgency they demand. Here is a look behind the scenes at how our development team prepared for, managed, and neutralised this vulnerability to keep your digital platforms protected.

Disclosure and awareness

On 20 October, the PHP Security Team issued a statement that a critical patch was being released, and strongly advised updating as soon as possible. As soon as that advisory landed, we shared the news and ensured that we were prepared the following day.

Our preparation focused on two areas:

• We reached out directly to our clients to explain the threat, outline our action plan, and set clear expectations around any brief service disruptions.

• We coordinated with our hosting partners to confirm that protective mitigations were ready to deploy across infrastructure where we do not have direct access to the servers.

Cloudflare and Web Application Firewalls

We are big fans of Cloudflare and its protection mechanisms, and once again it proved invaluable. Ahead of the official patch being released, Cloudflare updated its firewall rules to provide additional protection to all users— including those on their free tier.

This was particularly helpful as we were in the window between disclosure and the patch being released. The danger here is that malicious actors are able to reverse-engineer the exploit and begin attacks before updates are available. Cloudflare’s early rule deployment gave our clients an essential layer of defence while we prepared for the code release.  

The update process

The moment the official patch landed we immediately began to apply the updates to our customers’ infrastructure. The sheer volume of updates being made across the web caused capacity bottlenecks for several hosting providers, which caused noticeable slowdowns.

Our developers worked into the evening to push past those delays, and we are happy to confirm that all public-facing customer sites managed by Brew Digital are now fully patched and up-to-date. 

With the patches live, our team is now performing thorough audits to verify that no attempts were made to exploit the vulnerability prior to deployment.

Being Prepared

These incidents highlight the importance of having proactive processes and strategies in place. Rapidly neutralising a web-wide threat comes down to solid teamwork and long-term preparation. 

• Clear cross-team coordination: Our Project Managers were essential, serving as the direct link between the technical teams and our clients, quickly clearing developer capacity and rescheduling lower-priority tasks so we could dedicate our full focus to resolving the issue.

• Rapid auditing: Our monitoring and auditing tools provided us with immediate visibility across our entire hosting footprint, allowing us to review the current state of updates and prioritise deployments.

• Strong technical foundations: Security is an ongoing commitment, and should never be simply a reaction to a crisis. We maintain regular maintenance plans and multi-layered infrastructure (such as Cloudflare) to prevent there being a singular point of failure or extensive upgrade work. 

Not a single one of our customers was on outdated or out-of-support versions of PHP.

What this means for modern web security

Security timelines are shrinking, and these events will only become more common as AI-assisted security testing such as Anthropic’s Mythos and OpenAI’s Patch the Planet initiatives accelerate the finding of bugs and security holes in software. In this instance, the time from a patch being made public to a viable attack being detected by security monitoring organisations was approximately 55 minutes. 

Therefore, protecting your web presence cannot be reactive. It requires proactive maintenance, rapid response protocols, and continuous monitoring—ensuring that when an industry-wide vulnerability strikes, your business is protected before the threat reaches your door.

To find out more about how we proactively protect our customers with comprehensive monitoring, verified data recovery and ISO 27001 certified business continuity, visit our web hosting and maintenance page.