Other times, it’s sitting quietly underneath a website or application until a vulnerability disclosure suddenly pushes it to the top of the IT team’s priority list.
That’s the situation organisations are facing following the disclosure of critical vulnerabilities affecting PHP.
And this isn’t just another security advisory for the inbox.
Australian media reporting has documented websites being taken offline as organisations respond, while the Australian Government has issued a critical vulnerability alert.
That gives IT leaders an important signal: this is a legitimate risk being actively assessed and addressed locally and globally.
The vulnerabilities, being referred to by security researchers and some vendors as PHP2Shell, have triggered urgent attention across the cyber security industry.
According to information provided by the PHP Foundation and echoed by our security providers like Arctic Wolf and ThreatLocker, the vulnerabilities may allow an unauthenticated attacker to execute code on vulnerable systems. Public exploit information is available, increasing the importance of quickly finding exposed systems and applying relevant patches.
ThreatLocker is similarly recommending affected systems be patched immediately and potentially exposed web servers be investigated for signs of compromise or unauthorised activity.
The Australian Government has also published an alert regarding critical vulnerabilities in PHP, reinforcing the need for Australian organisations to take the issue seriously.
The important bit isn’t the catchy vulnerability name.
It’s knowing whether something your business depends on is exposed.
When vulnerability news breaks, it can sometimes be difficult to distinguish between an interesting technical discovery and something that deserves immediate operational attention.
What makes this event worth watching closely is the response already taking place.
Australian reporting from the ABC and Australian Financial Review has covered the impact of the PHP vulnerability and websites being taken offline while organisations respond.
Combined with the Australian Government’s cyber security alert and the actions being taken by major security vendors, it paints a clear picture:
Organisations aren't waiting to see what happens. They're assessing, patching and protecting systems now.
Taking a website or service offline isn't a decision an IT team makes lightly. Availability matters.
But there are circumstances where a temporary interruption is the right trade-off while a potentially serious security exposure is investigated and remediated.
For IT leaders, that's useful context when you need to explain internally why an emergency change, outage or accelerated maintenance window might be necessary.
This isn’t something the Truis team is simply monitoring from the sidelines.
Our security and managed services specialists have been actively reviewing potential exposure across environments we support.
That work has included checking services and systems we rely on, proactively assessing managed customer websites and directly engaging customers where something requiring attention has been identified.
It’s a useful reminder of why vulnerability management has to extend beyond the obvious servers inside your network. Modern technology environments are interconnected.
Websites, applications, third-party services and the underlying software components they rely on can all become part of your attack surface. A vulnerability several layers down the technology stack can still become your problem.
Start with four questions.
Identify potentially affected PHP installations, paying particular attention to internet-facing systems, websites and third-party applications.
Don't assume “we don't run PHP” necessarily means there is no exposure. PHP may form part of an application, website or service your organisation relies upon.
Confirm potentially affected systems against current government and vendor guidance and prioritise remediation according to exposure and business criticality.
The fact that organisations have been prepared to temporarily take public-facing systems offline shows that security versus availability can become a real operational decision during an event like this.
The right decision will depend on your environment and actual exposure.
Patching closes a vulnerability.
It doesn't answer what happened before the patch was applied.
Potentially exposed systems should therefore be investigated for indications of compromise or unauthorised activity.
Finding affected systems and completing remediation can take time.
This is where layered security controls become important.
PHP Foundation also provides guidance on what to do ‘if you cannot update immediately’
ThreatLocker advises that Application Allowlisting can prevent unapproved files from executing, while carefully configured Ringfencing policies can restrict what a compromised Windows service can interact with.
Arctic Wolf is also continuing to monitor the threat landscape, assess potential exploitation activity and update detection coverage and guidance.
These controls aren't substitutes for patching. They're additional defensive layers while organisations work through their exposure.
Finding the vulnerability is one job.
Explaining it to the business is another.
Your CEO, CFO, leadership team or board probably doesn't need a lesson on PHP.
They need four answers:
Serious enough that the Australian Government has issued a critical vulnerability alert and organisations are actively assessing and remediating potentially affected systems.
But the existence of a critical vulnerability does not automatically mean your organisation has been compromised.
That's what your technical assessment needs to establish.
If the answer isn't known yet, say so:
“We're assessing our environment against the newly identified PHP vulnerabilities, prioritising potentially exposed systems and following current government and security-vendor guidance.”
That's considerably better than rushing to offer reassurance you can't yet substantiate.
Give stakeholders actions, not acronyms:
“We're identifying potentially affected systems, applying relevant security updates, investigating exposed systems where required and monitoring for indications of suspicious activity.”
Potentially.
Reporting of organisations taking sites offline to undertake protective work gives IT leaders a useful real-world reference point.
If your assessment indicates that a vulnerable system needs to be isolated, patched or temporarily removed from service, explain the trade-off plainly:
“Keeping a vulnerable internet-facing service available may create a greater business risk than a controlled period of downtime while we secure it.”
That's a business decision executives can understand.
Our job during an event like this isn't to add more noise to an already busy IT team's day.
It's to help work out what matters.
Truis security and managed services specialists are working with customers to assess potential exposure, identify systems requiring attention and support appropriate remediation.
And for internal IT leaders, our role doesn't stop at the technology.
We can help you understand the technical issue, work through the relevant actions and give you the information needed to explain the situation to the people relying on you.
That's exactly how Truis approaches working alongside internal IT teams: expert guidance without trying to take over.
Because ultimately the questions aren't simply:
“Have we installed the patch?”
They're:
“Do we know where we're exposed?”
“Are we taking the right action?”
“And can we explain it clearly to our stakeholders?”
That's the more useful security conversation.
Concerned about your PHP exposure?
If you have PHP in your environment, aren't sure whether you do, or simply want another experienced team alongside yours, talk to Truis.
We can help assess potential exposure, work through the actions required and help your team navigate what comes next.
Speak to a Truis security expert →
Call: 1800 777 111 | (07) 3710 5000
Call from NZ: (09) 307 0520
Call International: (09) 307 0520
Now is also the perfect time to ensure you are signed up to receive the latest cyber security alerts and mitigation advice from the Australian Signals Directorate to make sure you are across the latest news in this evolving situation.
Sign up here - https://www.cyber.gov.au/sign-up-for-alerts
Australian Government – Critical vulnerabilities in PHP
Current Australian Government cyber security guidance on the vulnerabilities.
[Read the Australian Government alert]
ABC News – Australian reporting on the critical PHP vulnerability
Independent Australian reporting providing wider context around the issue and its potential impact.
[Read the ABC report]
Australian Financial Review – Global response to the PHP vulnerability
Reporting on websites going offline amid the international security response.
[Read the AFR report]
Arctic Wolf – Finding, Prioritizing and Patching PHP2Shell Exposure
Guidance from Truis security partner Arctic Wolf on identifying and prioritising potential exposure.
[Read the Arctic Wolf guidance]
Security guidance around an actively developing vulnerability can change quickly. Always refer to the latest government and relevant technology-vendor advisories when making remediation decisions.