Today, Wednesday 21 October, news broke worldwide about two serious security flaws in PHP. PHP is the programming language behind a large share of all websites, including Buurtje.nl. The flaws became public earlier than planned, before the official update was ready. During the morning the first attacks on websites were reported.
What we did
We did not wait for that update. Within fifteen minutes of the first news, we had switched off the vulnerable part of PHP on our servers. More measures followed during the morning:
- The parts of PHP that contain the flaws are switched off. Their work is temporarily handled by our own secure solution.
- Suspicious traffic is filtered more strictly before it reaches our servers.
- We are monitoring our servers continuously.
Buurtje.nl stayed online all day. Searching, reading and writing reviews and your account work as usual.
What does this mean for you?
You do not need to do anything. There are no signs that user data has been at risk, and you do not need to change your password.
What happens next
The PHP developers will release the official update later today. We will install it as soon as it is available and then remove the temporary measures. If anything changes, we will update this article.
Any questions? Feel free to email us at info@buurtje.nl.
Update 21 October, 16:15
The PHP developers have released the official update. It is now installed on all our servers, and we have switched off the temporary measures again. Buurtje.nl now runs on the secured version of PHP.
