You may have seen headlines this week about a serious security flaw affecting websites around the world. If you’re a Juniper client, we want to reassure you straight away: your website isn’t built on PHP, so it isn’t affected by this vulnerability. In this post, we’ll explain what’s happened, why our websites sit outside the danger zone, and what we do to keep them that way.
What’s happened?
On 20th October, details of two critical vulnerabilities in PHP leaked online before a fix was ready. The vulnerabilities have been nicknamed “PHP2Shell”. PHP is the programming language behind a huge share of the web, including WordPress, Drupal, Joomla and Magento.
Both flaws are rated 9.2 out of 10 for severity. They could allow an attacker to run their own code on a web server without needing to log in. The PHP team released emergency patches the following day. Security agencies in Europe and the US have urged anyone running PHP to update immediately, and some organisations, including Dutch government services, took their websites offline as a precaution. You can read more in the BBC’s coverage.
If you have a website running on WordPress or another PHP platform, it needs updating now. It’s worth checking with whoever looks after it.
Why our websites are different
Since we started in 2020, we’ve chosen not to build on PHP or WordPress. Instead, we use static site generation: first with Gatsby, and more recently with Next.js.
On a traditional WordPress site, every page visit sets off a chain of events. The server runs PHP code, queries a database and assembles the page on the spot. Each of those steps is a door that needs locking, and a flaw like PHP2Shell can open all of them at once.
Our websites work differently:
- Pages are built ahead of time. They’re served as ready-made files from Netlify’s global network, rather than being generated by a server on every visit.
- Your content lives separately. It’s managed in Prismic, a hosted headless CMS that sits apart from the website itself.
- There’s no database or admin login sitting behind your website for attackers to target.
- Dynamic features run in isolation. Where a site needs features like forms or search, these run as small serverless functions written in JavaScript, not PHP.
What about WordPress sites we look after?
We do support a small number of legacy WordPress websites that we inherited rather than built. These have been checked and patched against PHP2Shell, either by us directly or by their hosting provider at server level. If you’re one of these clients and would like to talk about moving to a static setup, we’d be happy to discuss it.
No technology is bulletproof
We’d be doing you a disservice if we claimed our approach was immune to every threat. Next.js and the wider JavaScript ecosystem have their own security issues from time to time, and we take those just as seriously.
What a static approach gives you is a much smaller attack surface. There are fewer moving parts, fewer places for problems to hide and fewer things that can go wrong.
What we’re doing
- Monitoring security advisories for the frameworks and packages we use.
- Applying updates promptly, particularly for clients on our Support & Maintenance packages.
- Working with trusted platforms like Netlify and Prismic, which patch their own infrastructure at platform level.
Any questions?
If you have any concerns about your website, please get in touch. We can also take a look at a website we didn’t build, or talk you through what moving to a faster, more secure static setup would involve.
Sources:
