PHP breach… that's it ! - Blackpepper Studio

PHP breach… that’s it !

That’s it… After a few weeks under the bonnet, I’ve finally wrapped up a series of patches addressing the PHP vulnerability — the infamous ‘PHP2Shell’, the one that took government websites offline and put the NSA, the FBI and CISA on high alert… As part of Blackpepper’s WordPress maintenance contracts and a few one-off requests, all the sites we manage have now been thoroughly checked, updated and secured.

A useful clarification: this wasn’t malware, but a vulnerability in the very core of PHP, the language that powers around 70 per cent of the web, with WordPress leading the way. And it was AI agents that uncovered it — researchers at Calif using GPT-5.6 Sol, as part of OpenAI’s ‘Patch the Planet’ programme, followed independently by the teams at Wiz. The vulnerability had been lurking in the code for over ten years; generations of human auditors had passed over it without noticing. The AI, however, looked where no one else was looking anymore.

But a vulnerability also presents an opportunity: the chance to pass a full security check. Preventive audits have revealed genuine malware – very much present, but not always active: discreet tenants paying their rent in secret. Above all, many websites were simply… never checked.

Yet we go to the doctor for a blood test once a year, or as soon as a niggle is bigger than a plaster. A website, on the other hand, just keeps running and running – until the day when…

Scrutinising the various websites hosted by Infomaniak and KreativMedia showed me just how many sites are simply not considered at all from this perspective. And that is the real issue: a website that has been delivered is not a living website, neither in terms of security nor efficiency. Often, maintenance – both technical and content-related – was never addressed, either during its design or upon delivery. Many owners end up with a website as if it were a file stored locally: a beautiful, static presentation that is shown to the client twice a year.

But a website is something else entirely. It’s a vehicle: nobody buys a second-hand car without the service history – the one that reminds you, as well as tyre pressure and oil levels before every journey, of the timing belt, oil changes and major services that prevent breakdowns. On the web, the same discipline applies.

Here’s a reminder from Blackpepper’s standard maintenance log , to pinabove your desk or stick on your fridge:

Updates to the CMS, themes and extensions for each domain/subdomain on a hosting account
Updatethe PHPversion for each oneas well
Create/activate a user-friendly and reassuring maintenance page, featuring contact details and social media links,but excluding GTM as it would skew GA4 statistics
Back up the database beforehand — as extensions aren’t always the best ‘roommates’, especially if they haven’t been tested beforehand
(Periodic) renewal of all passwords: CMS users, FTP (files), databases
Renewal of the hosting provider’sPHP password – coordinating with the operators of other sites and subdomains hosted on the same server (much like changing the switchboard number for a fleet of taxis)