If you’ve seen an email or news headline this week about “Critical Vulnerabilities in PHP,” you may be wondering whether your website is affected.
Your Perfect Patients website has already been patched. Our systems team applied the fix on October 21, the same day it was released. There’s nothing you need to do.
Here’s a quick explanation of what happened, in case you’d like to know more.
What Happened
PHP is the programming language that runs behind the scenes on a huge share of the internet, including WordPress. You never see it, but it’s working every time someone visits your website.
Security researchers found two serious flaws in PHP, now nicknamed “PHP2Shell.” According to Help Net Security, these flaws could let attackers run code on a web server without needing to log in. Both were rated critical, at 9.2 out of 10.
Details leaked online on October 20, before a fix was available. The PHP team released updated versions on October 21, and security providers around the world sent out urgent warnings. That’s why this alert may have reached your inbox.
What We Did
Our systems team was tracking this from the moment the news broke. The updated version of PHP was applied to the servers that host Perfect Patients websites on October 21.
You don’t need to log in, install anything, or change any settings. Server updates and security are part of what we manage for you.
Two Things Worth Keeping in Mind
- Websites hosted elsewhere: If your practice runs any other website or tool outside of Perfect Patients, such as an online store, a separate booking site, or an old website, ask that provider whether they’ve applied the October 21 PHP update.
- “Click here to fix it” emails: Big security news is often followed by scam emails. Be cautious with any unexpected message asking you to click a link, download a “patch,” pay for an emergency fix, or share your login details. We will never ask for your password to apply a server update.
The Bottom Line
This was a serious vulnerability, and the warnings were justified. For Perfect Patients websites, it was handled the same day the fix became available, and your site is protected.