Many services people use online rely on software they never see. Last week, two major security weaknesses were found in a piece of software called PHP, which helps to run millions of websites. IT teams around the world had to drop everything to fix these weaknesses.

And for good reason! The weaknesses, known collectively as PHP2Shell, could let attackers into vulnerable servers without logging in, potentially exposing sensitive information or knocking services offline. While fixes have been made and IT teams have implemented them, for councils the worry goes beyond their main website. What about their old legacy applications and third-party systems?

First of all, what even IS PHP?

PHP is a programming language that makes websites and online services work. To use an analogy: if a website were a restaurant, the pages you see are the dining room, and PHP is the kitchen. You never go into the kitchen, but it is where your order is prepared every time you open a page, complete a form or make a booking.

Under certain conditions, the two weaknesses identified last week would have let an attacker send a specially prepared request to a vulnerable server and have it run their own instructions, with no username or password required. Depending on the system and its security controls, that could allow criminals to access information, interfere with a website, or install malicious software.

This does not mean every website using PHP has been attacked. The PHP Foundation’s official explanation covers the discovery and the fixes in more detail.

Have your council systems been affected by PHP2Shell?

If your IT team are any good, most likely not… but never say never!

Many councils use PHP for their public websites, online forms, portals, booking services and department applications. Plenty also have older sites still running quietly in the background, getting far less attention than the main council website.

Let’s imagine a council that has not applied the PHP update, and they have an online form residents use to sign up for clinical waste collections. If an attacker exploits the system behind it, the names, addresses and other sensitive details residents have submitted could be exposed, or the service could be disrupted altogether, leaving residents unable to report problems, submit applications or find important information. Not good!

That said, not every PHP installation can be exploited in the same way. The risk depends on the software version, how the server is set up, how the application behaves and what security controls are in place. Councils should assess their actual exposure rather than assume every PHP service is seconds away from disaster.

What should councils do about PHP2Shell?

This is not something you can sweep under the rug! The NCSC (the UK’s National Cyber Security Centre) has advised organisations to act immediately, paying particular attention to internet-facing systems, and to consider taking offline anything that cannot be fixed straight away. For council IT teams, the following three priorities should be followed.

1) Find it: which systems could be affected?

Start by working out where PHP is used: the main website, individual service applications, older departmental sites and any relevant supplier systems. Yes, that includes the microsite you built 10+ years ago that nobody uses anymore!

Anything obviously out of date needs a look, especially as PHP 8.1 and earlier are no longer officially supported, so fixing them may depend on the supplier or require an upgrade. Because the weaknesses affect multiple versions, recently maintained systems need checking too. For each system, the council should know which PHP version it runs, who maintains it, and whether the October updates have been applied.

2) Fix it: patching vulnerable systems

Your IT team should install the latest appropriate security updates and check whether software providers have issued any extra instructions. Some suppliers deliver fixes through their own software packages (i.e. backporting), so the version number on screen does not always tell the full story.

If a system cannot be properly protected, the council may need to switch the service off temporarily until it is secure, depending on how important it is and what alternatives residents can use in the meantime.

3) Check it: has an attack actually happened?

This is the step that is easiest to miss. A security update stops the original weaknesses being exploited in the same way, but changing the locks does not tell you whether someone was already inside. Attackers did not wait for the announcement: Amazon’s threat intelligence team recorded an attempt to exploit PHP2Shell on 17 October, four days before the fixes were made public!

The council should look for evidence of unauthorised activity by reviewing server logs, investigating unusual behaviour and checking for unexpected changes to files, accounts or settings. It should also consider whether an attacker could have left themselves a spare key that still works after the update. Where compromise is suspected, councils should preserve the evidence and follow their established incident response procedures, bringing in specialist help if they cannot confidently work out what happened or whether the threat has gone.

What should councils take away from PHP2Shell?

PHP2Shell is a reminder that even established, widely used technology can hide serious weaknesses. Knowing which systems are in use, who maintains them and how security problems get fixed makes a huge difference when the next vulnerability comes along. With cyber security experts using AI to check for vulnerabilities, it will not be long before the next one!

Ultimately, the question is not whether a council uses PHP, but whether it can spot and manage vulnerabilities quickly, protect residents’ information and keep essential services running when security issues arise. The councils that know what they run, who looks after it and how quickly it can be fixed will be ready to meet the challenges of the coming years.

For a wider discussion of general steps you can take to keep yourself secure, check out our Cybersecurity article by clicking HERE.