Giant Rabbit’s Cybersecurity Response: PHP2Shell Vulnerability Incident

If you or a loved one were anywhere near the internet recently, you might have heard about PHP2Shell. PHP2Shell is the name for two recent critical vulnerabilities that were disclosed that affect PHP, the scripting language that runs on servers and powers an estimated 70% of the web. (WordPress, Drupal, and Backdrop CMS are all platforms written in PHP.) In the wake of this disclosure, tech providers worldwide scrambled to secure their assets.

As a small, independent managed web hosting provider for nonprofits powered by a team of nineteen, we at Giant Rabbit needed to act quickly to update the hundreds of websites and servers in our ecosystem – an achievable challenge because we had been keeping our clients up-to-date with software and operating systems updates through our nonprofit cybersecurity services.

Giant Rabbit stays ready so we don’t have to get ready.
Kilah Haight, Giant Rabbit Systems Administrator

Staying ready was key for this particular vulnerability: we were able to secure our sites and deploy the fix across our server ecosystem within a few hours of the vulnerability’s disclosure. Here is Giant Rabbit’s timeline for handling this vulnerability and improvements we’ve identified for the next time for all nonprofit websites managed by Giant Rabbit:

August 1st – October 19th, 2026

Two vulnerabilities are discovered and reported to the PHP security team. PHP gets to work creating patches and sets a patch release date of October 22nd. This all happens in secret, with some coordination with vendors who release packages for major systems like Ubuntu. (Ubuntu is the operating system that runs on most Giant Rabbit-managed website host servers.)

October 20th

Plot twist: information about the vulnerabilities leaked! The PHP development team notifies the internet community to expect an urgent, critical update on October 21st, a day ahead of the original schedule.

October 21st
7am Pacific

PHP releases their security notice: there are two critical code execution vulnerabilities that could allow someone unfettered access to our clients’ (and millions of other sites’) servers and data.

They release a new version of PHP that addresses the vulnerabilities, and it’s now a race against time to get this update in place.

The catch is that the packages from the operating system vendors aren’t yet ready because the release is early.

The vulnerability information comes with one mitigation, which is to set session.upload_progress.enabled = 0 in the php.ini file. As we wait for the packages to be released, we run ansible scripts (the software we use to manage our server) to update the php.ini files on all the servers with this mitigation.

8am Pacific

Our website cybersecurity team starts hearing early reports of live exploits on other platforms across the internet, and news breaks that governments around the world are shutting down their websites. PHP announces that there’s no complete mitigation.

For the first time in Giant Rabbit history, we make the extraordinary decision to take all PHP-based Giant Rabbit sites offline with a rapid response shutdown procedure to protect our clients’ data and technical infrastructure.

8:15am Pacific

All PHP-based sites that Giant Rabbit maintains have been disabled using our ansible playbooks. Our developers and project managers begin the process of notifying our clients about the outage.

9am Pacific

Ubuntu releases the updated Ubuntu PHP packages, but only supports one package per operating system version. Updated packages for all other versions of PHP are still not available to the Ubuntu package updating systems, but they are available for download on the Personal Package Archive’s (PPA) website.

We decide to manually download the packages from the PPA and write an ansible playbook to upload the packages to the servers and install them.

As soon as we verify that the correct PHP version is in place for each website we manage, we bring each site back online and let clients know they’re secure.

11am Pacific

Our team successfully updates the last of our servers and most of the websites in our care.

7pm Pacific

Our team completes updates for the last few particularly custom sites that need special handling.

Knowing what we know now, we have two process improvements we are working on to mitigate site downtime and the delay we experienced waiting for packages to be released:

First, we are deploying Web Application Firewall (WAF) software to our servers. This will let us add rules to temporarily block any attacks, allowing the website to stay up and buying us more time to deploy updated packages.

Second, we are updating our ansible systems so that we can build packages from the source. That way, we won’t need to wait for vendors to distribute their updated package versions.
In the meantime, we’ll continue running our updates, one platform at a time, providing premium nonprofit website maintenance, site cybersecurity, and nonprofit technology support – knowing that preparation is the best prevention.