Still running PHP 7? October's flaw has no fix for it

Picture opening your laptop on Monday morning to find your online store down, or your customers getting strange emails in your company's name. It almost always starts with something nobody was watching: the version of some forgotten software on the server.

Right now, for a lot of companies, that software is PHP 7.

First: what PHP is, and why this is about you

PHP is the programming language that runs a huge part of the internet: online stores, WordPress sites, customer portals, custom internal systems. You probably never chose PHP. Someone chose it for you, years ago, and it has worked fine until now.

What happened, in a few words

On October 21, the people behind PHP warned about two serious flaws, rated 9.2 on a scale that goes up to 10. In practice, they let someone on the internet take over the server your site runs on, without a password.

Five days later, the US government's cybersecurity agency (CISA) added the flaws to its list of those already used in real attacks.

The fix came out on the 21st. But only for PHP 8.2 and newer.

What this could cost your company

• Your site or system down in the middle of the working day, or right on the day of a sales campaign.
• Customer data exposed, like accounts, orders and emails. Besides the damage to trust, a personal data leak can lead to lawsuits and fines under privacy laws.
• Your site working for criminals: sending spam or spreading scams. Then Google starts warning people that your site is dangerous.
• The cleanup bill: recovering a hacked server costs far more than preventing it.

We're not saying this to scare you. Flaws like these are exploited at scale, by bots that sweep the internet for any vulnerable server. Nobody has to pick your company on purpose: it just has to be in the way.

So, just update?

That would be great, but it's rarely simple. Companies still on PHP 7 are usually there for a good reason: the system works, it makes money and nobody wants to touch it. Moving to PHP 8 changes some of the language's rules, and parts that used to work can stop. Old plugins, outdated frameworks and code written years ago are the first to break.

Updating blindly just trades one risk for another. The safe way is to know beforehand what will break, what it costs and in what order to do it.

Don't know which version you run? That's normal. It's the first thing we find out for you.

Answer these five questions

• Which PHP version do your company's sites and systems run on?
• Who takes care of server updates, and do they still work with you?
• When was the system's last big update?
• If your site went down today, how much would the company lose per day?
• Is there a recent backup, and has anyone tested that it works?

If any answer was "I don't know", you're not alone. Plenty of companies are in the same spot, and that's exactly where we come in.

How 360 Brave sorts this out with you

We're a software engineering studio. In our PHP impact assessment, we look at everything your company has running, explain the risk in business terms and hand you a plan with a fixed timeline and price.

1. 01

   A 20-minute conversation

   You tell us how your operation works, in your own words. No commitment and no jargon.

2. 02

   Diagnosis

   With read-only access, we map every PHP site and system, their versions, what's exposed to the internet and what would break in an update.

3. 03

   A plan you understand

   A list of what to do first, ranked by risk to the business, with timeline and price. It includes immediate steps to reduce exposure while the update gets done.

4. 04

   An update without surprises

   We update in stages, with tests and a way back, so the system doesn't stop. If you prefer, we hand the plan to your team.

Then, if it makes sense, we look after your server on an ongoing basis. That way the next flaw becomes a routine update, not a Monday-morning emergency.