PHP Security Incident, 21st October 2026
Last updatepostmortemOct 22 · 04:27 UTC
This post mortem was circulated by email at 05:30 on Thursday 22nd October.
Hello,
I’m writing to explain yesterday's disruption to ShopWired, why we took the decision to temporarily suspend services, and the steps we took to protect the platform and our customers.
Firstly, I and the rest of the ShopWired team offer our sincere apologies for the disruption to your business yesterday. I recognise that many of you rely on ShopWired to trade throughout the day, and that the interruption will have resulted in lost sales, inconvenience and disruption to your customers.
I want to personally explain what happened and why I made the decisions I did.
What happened?
On 21st October, two critical security vulnerabilities were disclosed affecting PHP, a widely used technology that powers a significant proportion of websites around the world, including ShopWired.
These vulnerabilities were extremely serious. If exploited, they would allow an attacker to execute malicious code on a vulnerable server without needing to log in.
The implications of a successful attack on ShopWired could be very severe, allowing attackers to potentially access sensitive information or interfere with the operation of affected systems.
This was not an issue specific to ShopWired. It was a security emergency across the internet, affecting millions of individual websites and platforms like ShopWired.
The scale of the threat was such that government websites, hospitals and other major services in the UK and internationally were temporarily taken offline as a precaution.
The UK's National Cyber Security Centre (NCSC) and NHS England both issued urgent security alerts. The NCSC specifically advised organisations to consider taking affected systems offline.
You can read more about the incident from independent news organisations and official sources:
- Reuters — PHP developers release critical security fixes as websites go offline
- Associated Press — Websites taken offline following discovery of critical PHP vulnerabilities
- BBC-independent technology reporting: WIRED — Critical PHP vulnerabilities prompt worldwide security response
- UK National Cyber Security Centre — Official security alert
- NHS England — Critical vulnerabilities in PHP
How ShopWired responded
We became aware of the vulnerabilities as soon as information about them became public and immediately began investigating the potential impact on ShopWired.
Our engineers began introducing preventitive additional security measures during the early hours of 21 October, before the full technical details of the vulnerabilities were available.
As further information emerged, we strengthened those measures.
At approximately 13:36, we temporarily disabled file uploads and imports across the platform to reduce potential exposure - which was thought to be the main attack route for the exploit.
At the same time, major internet security providers, including Cloudflare, were reporting emerging attack attempts across their networks. Information about how the vulnerabilities could potentially be exploited was also circulating publicly and available to anyone with access to the internet.
The situation became increasingly difficult because the security patches had not yet been released, and there was considerable uncertainty about whether temporary protective measures would be sufficient.
Why we took ShopWired offline
As more technical information became available, it became clear that ShopWired's infrastructure could potentially be vulnerable.
I faced a difficult decision.
If we kept the platform online, allowing our users to continue trading and displaying their websites, we had to accept the possibility that attackers could attack ShopWired, exploit the vulnerabilities and cause catastrophic damage and steal customer data.
Alternatively, we could temporarily suspend services and bring the platform “down” until the vulnerabilities had been addressed.
At approximately 15:11, in consultation with the engineers, I made the decision to take ShopWired offline. Not because we were being attacked, but because if we were attacked and data was stolen it would be incredibly harmful to both ShopWired and our merchants.
This was not a decision that I and the rest of the team took lightly.
Thousands of businesses use ShopWired to operate their websites, and the platform processes and stores well over a million customer records and huge numbers of other information relating to our users and their customers.
I felt that protecting that information, and the integrity of the platform, had to take priority over keeping services available whilst the security risk remained unresolved. I knew that the patch was coming and that we would be able to apply it and that our engineers were ready to do so.
The decision to take the platform down was consistent with the advice being issued by national cybersecurity authorities, and similar precautionary shutdowns were taking place at other organisations around the world.
Why restoring services took several hours
The official PHP security patches were released during the afternoon of 21 October.
However, releasing a software patch does not mean that every organisation can immediately install it.
ShopWired, like many other organisations, relies on specialist software repositories that build and distribute compatible versions of PHP for the operating systems and server configurations in use.
These services needed to prepare and publish their own updated packages.
The disclosure of the vulnerability and its patch was not originally scheduled for yesterday but had to be brought forward because details of the vulnerability had already leaked. This left the services that distribute the patch rushing to finalise their fixes.
Unfortunately, the repository we relied on was also experiencing availability problems, as well as our main backup repository.
During this period, our technical team continued preparing and applying updates, verifying configurations and testing the changes necessary to restore services safely.
We also needed to ensure that the updated software was compatible with ShopWired's infrastructure before allowing customer traffic to resume.
At approximately 18:38, the necessary upgrades had been completed and ShopWired was brought back online.
Communication during the disruption
Throughout the incident, we published updates on our service status page:
https://status.shopwired.co.uk
We recognise that the situation developed quickly and that it was difficult to provide precise restoration times whilst we were waiting for security patches and completing the necessary upgrades.
We did our best to communicate developments as they occurred, although we appreciate that the uncertainty will have been frustrating.
What happens next?
We are conducting a thorough review of yesterday's events, including our technical response, the time taken to apply the security updates and whether there are improvements we can make to our procedures.
We will also review how we communicate during major incidents and whether there are further steps we can take to reduce disruption in similar circumstances.
The security of ShopWired and the information entrusted to us by our customers is a responsibility we take extremely seriously.
Finally
We have been working through the night to look for any evidence of any attack or successful exploit of the vulnerability on ShopWired - we have not found any evidence that ShopWired was attacked.
I fully recognise the impact yesterday's disruption will have had on your business.
For some merchants, several hours without their website being available will have meant missed orders, lost revenue and disappointed customers. I do not underestimate that impact.
However, faced with the possibility of a serious security compromise, I believe temporarily suspending services whilst we applied the necessary fixes was the responsible decision.
Again, I - along with the rest of the ShopWired team - would like to sincerely apologise for the inconvenience that you will have suffered and thank you for your patience and understanding.
Reported by ShopWired on their status page.