Your website is already patched

You may have seen reports on BBC News and elsewhere over the last day about a serious security flaw in PHP. PHP is the software that runs a large share of the world's websites, including the servers behind Envelope.

The short version: your website was patched on Wednesday afternoon, it stayed online throughout, and you don't need to do anything.

What happened

On Tuesday evening the PHP team announced two critical vulnerabilities, now known as PHP2Shell. Left unpatched, they could let an attacker take control of a web server. Both were rated 9.2 out of 10 for severity, and the official fix was scheduled for 3pm on Wednesday 21st October.

What we did

Our own security monitoring flagged the announcement first thing on Wednesday morning. We put precautionary protections in place before the fix existed and had everything ready to go.

Morning: Alert received, precautions applied, patching procedure prepared.

2:53pm: Patches released a few minutes early. We started applying them straight away.

5:03pm: Whole fleet patched, restarted and stability tested. No downtime.

What it means for you

Nothing changes on your side. You don't need to update anything, take your site offline or contact anyone.

If your IT provider or anyone else asks whether your website is affected, you can tell them it's hosted on Envelope and was patched on 21st October. We're happy to confirm the details with them directly.

This is why Envelope is run the way it is. Updates are managed centrally, the platform is built so we can patch without taking sites down, and someone is watching for this kind of announcement before it reaches the news.

This stuff happens.

When it does, we deal with it.

If you have any questions at all, get in touch.