What is this about?

PHP is the programming language that WordPress, WooCommerce and Joomla are built in, among others, and that most websites on a web hosting plan run on.

The two vulnerabilities can make it possible for an attacker to run their own code on a web server without logging in. The flaw is in PHP itself, not in a specific CMS or plugin. A website could therefore be exposed even if its own code was fully up to date and secure. The PHP project rates both flaws as critical and urges everyone to update immediately.

What we did

• Before the fixes were ready, we put temporary safeguards in place against the known attack methods on all our servers.
• We installed the fixes the same day the PHP project released them. By 18:16 CEST, all our servers were running the fixed versions.
• Afterwards, we removed the temporary safeguards again on the fixed versions, so everything runs as normal.

Which PHP versions are fixed?

Using PHP 7.4, 8.0 or 8.1? The PHP project no longer maintains these versions. Because the vulnerabilities are so serious, it has made a fix for them anyway, and we have installed it. The fix has been backported to your existing version, so the version number may look unchanged, but your website is protected.

Using PHP 7.3 or older? No fix exists for versions this old. We have kept the extra protection in place, but it is no substitute for a fix, and we strongly recommend switching to a newer version.

Have you read about the vulnerabilities in the media?

The vulnerabilities have received a lot of coverage, and advice is being given to everyone who has a website. Here is what that advice means for you as a Simply.com customer.

Does my website use PHP?
If you have web hosting with us and your website is built with, for example, WordPress, WooCommerce or Joomla, it uses PHP. You can see which PHP version it uses in our control panel.

Do I need to update PHP myself or shut down my website?
No. We update PHP on our servers, and that has already been done. You don’t need to shut down your website.

Should I check whether anyone has accessed my website?
It’s always a good idea to keep an eye on your website. You can download the web server’s log files in our control panel. See how in our guide to log files. If you see content, files or users you didn’t create yourself, or you’re in doubt, contact our support.

Also remember to keep your CMS, plugins and themes up to date. That protects against the vast majority of attacks, including those that have nothing to do with PHP itself.

Do I need to do anything?

No, you don’t need to do anything.

We do recommend always using a PHP version that the PHP project still maintains, i.e. PHP 8.2 or newer. Only those versions receive ongoing security fixes. You can switch PHP version yourself in our control panel. See how in our guide to PHP versions. Take a backup first, and check your website afterwards.

Stay updated

We have posted updates on the matter on our server status page. You can also follow the status of our servers there at any time.

If you have questions, feel free to contact our support.

The post Critical PHP vulnerabilities fixed on all our servers appeared first on Simply.com blog.

Simply.com has no plans to remove or stop offering PHP 7.4, just as we still offer several other PHP 7 versions (and even PHP 5.6).

We will set our default PHP version to PHP 8.0 when WordPress and various themes start recommending it over PHP 7.4. We’ll give plenty of notice before making any changes.

If you want to use PHP 8, you can set this up for your web space – read more about this here: https://www.simply.com/en/support/faq/php/503/

The post About PHP 7.4 end-of-life appeared first on Simply.com blog.

This means that is time to upgrade our default PHP version from PHP 7.2 to PHP 7.4.

From tuesday the 25th of August 2020 we will be offering the following PHP versions:

• PHP 5.6 (slow and old)
• PHP 7.0
• PHP 7.1
• PHP 7.2
• PHP 7.3
• PHP 7.4 (our new default version)

If your Simply.com web space is currently using PHP 7.2, it will be upgraded to PHP 7.4 automatically after the 25th of August 2020.

You thereby do not need to do anything in this regard.

We have chosen to skip PHP 7.3 as WordPress currently recommends PHP 7.4, and it is our goal to follow WordPress’ recommendations in the future.

Most CMSs have long supported PHP 7.3 and PHP 7.4 so there should not be any problems upgrading – see https://www.php.net/manual/en/migration73.incompatible.php for a list of breaking changes.

Remember that you can also choose which PHP version you want your web space to run now. Read more about this here: https://www.simply.com/en/support/faq/php/503/

The post PHP 7.4 Upgrade appeared first on Simply.com blog.

Through several PHP updates, however, we have seen that many customers wish to remain on a specific PHP version as their shop or CMS does not support the newest PHP version, and the process of upgrading it is not always as tangible as one would like.

We therefore now offer that customers can choose a specific PHP version for their web space. This means, that if you use for example Magento 2.1 (which specifically demands PHP 7.0) or Prestashop (which demands PHP 7.1), you can now actively choose this and always use this PHP version in the future.

This of course also means that you miss out on all of the benefits in the new PHP versions, but by selecting a specific PHP version you can choose yourself when to upgrade.

You can read more about how you choose a specific PHP version for your web space here: https://www.simply.com/en/support/faq/php/503/

The post Choose a specific PHP version appeared first on Simply.com blog.