This month, two critical flaws in PHP, the technology behind most of the world’s websites, left thousands of UK businesses exposed. Across the Owlis Group, including ADNS, we identified affected customer environments, assessed risk and completed the vast majority of remediation activity within 24 hours of the PHP2Shell incident.
The vulnerabilities themselves have now been addressed. The bigger lesson remains: cyber risk doesn’t stop at your firewall. Your supply chain can be just as important as the systems you manage directly.
What happened?
On 20 October, two critical PHP vulnerabilities, now widely referred to as PHP2Shell, were disclosed. The flaws allowed attackers to potentially gain control of affected web servers without valid credentials, and exploitation activity was observed almost immediately.
The scale of impact was huge. PHP underpins an estimated 70% of websites, including platforms such as WordPress, WooCommerce and Magento. It is also embedded within a range of internet-connected devices, from network storage appliances to management interfaces and other business systems.
The challenge for many organisations was that remediation wasn’t always straightforward. While newer PHP versions received official security updates, many older platforms relied on hosting providers, software vendors or third-party developers to deliver patches.
For Jamie Allinson, Managing Director at ADNS, the first indication of the issue came from two directions at once.
“A customer called us because a website within their supply chain had gone offline. At almost exactly the same time, alerts started appearing across the industry. From that point, it was clear this was going to have widespread impact.”
How we responded
Our approach to the PHP2Shell incident was simple: treat it as a critical incident from the outset. A master incident ticket was raised, affected technologies were identified, responsibilities allocated and customer communications began.
Our technical teams immediately began reviewing internet-facing infrastructure under management, validating exposure and deploying remediation where required. At the same time, we turned our attention to an area many organisations overlook: systems managed by third parties.
For websites, hosting platforms and externally managed applications, customers were advised to contact providers and establish two things:
- Do you use PHP?
- If so, have you patched it?
Across the Owlis Group, teams had already begun triaging affected environments before the first wider coordination calls took place.
Alongside remediation, communication became a major focus. Many organisations simply struggled to get answers from hosting providers or web agencies and needed clear guidance on the practical steps to take. In higher-risk scenarios, we recommended temporarily taking websites offline until security updates had been applied and compromise ruled out.
“That’s never an easy conversation because websites are often business critical. But a temporary outage is far less damaging than exposing customer data.”
Ian Nowosad, COO, Owlis
Why did it affect so many businesses?
Because websites are often treated differently from the rest of the IT estate. Most businesses have processes for patching laptops, servers and firewalls. Websites frequently fall into a grey area between internal teams, hosting providers and external agencies.
Over time, that creates risk. WordPress sites, particularly those built several years ago, can accumulate dozens of plugins and integrations. Each introduces another dependency that needs securing, maintaining and updating.
For ecommerce businesses, the stakes are even higher. Platforms such as WooCommerce and Magento often process or store customer information, making them attractive targets for attackers.
There is also a compliance dimension. Organisations are responsible for protecting the personal data they collect, regardless of where that data sits. If a breach stems from an unpatched website, “our web developer looks after that” is unlikely to be a satisfactory answer.
The real lesson behind PHP2Shell: your supply chain is part of your attack surface
The vulnerabilities themselves will be patched. The exposure they highlighted is much harder to solve.
Most organisations rely on a network of suppliers to host websites, process payments, manage bookings, store data and deliver business-critical services.
Every one of those relationships introduces risk. In this case, the first call we received wasn’t because our customer’s systems had failed. It was because a business within their supply chain had been affected.
“Supply chain risk is one of the most overlooked areas of cyber security. Many organisations don’t fully understand what information their suppliers hold, where it’s stored or what impact a breach could have.”
Jamie Allinson, Managing Director, ADNS
That same principle applies to us. Alongside assessing customer environments, we were also engaging our own suppliers to understand their exposure and response.
A useful starting point is asking two simple questions:
- What systems connected to the internet support your business?
- Who is responsible for securing each one?
If you’re not confident in the answers, that’s worth addressing now rather than after an incident.
What should you do now?
First, don’t panic. Then work through these steps:
- Confirm whether your website relies on PHP.
- Ask your provider whether it was affected and when remediation was completed.
- If you cannot get a clear answer, escalate until you can.
- Consider a vulnerability assessment of your website and associated infrastructure.
- Review key suppliers and understand what customer or business data they hold.
- Follow trusted guidance from the National Cyber Security Centre (NCSC).
“The worst thing you can do during an incident is assume someone else is dealing with it. Ask the questions and get the answers.”
Ian Nowosad, COO, Owlis
Why preparation matters
The reality is that vulnerabilities like the PHP2Shell Incident will continue to emerge. No organisation can prevent every zero-day threat. What separates well-prepared businesses is how quickly they identify exposure, make decisions and respond.
Our response was possible because the foundations were already in place. We knew our customers’ environments, understood ownership across suppliers and had a defined incident response process ready to activate.
That’s exactly what strong compliance, governance and risk management should deliver:
- Regular vulnerability assessments across networks and websites
- A clear record of systems, suppliers and ownership
- Business continuity and disaster recovery planning
- Ongoing support for compliance frameworks including ISO 27001 and ISO 42001
- Clear accountability when incidents occur
The goal isn’t to eliminate risk entirely. The goal is to understand it, reduce it where possible, and be ready when something unexpected happens.
“You want to be ahead of the game, not chasing it.”
Jamie Allinson, Managing Director, ADNS
Know where you stand
If you’re unsure whether your website, hosting platform or wider supply chain was affected, don’t wait for the next headline. We’ll assess your exposure, identify any risks and provide a clear report you can use with your provider or internal team.