How we dealt with the PHP vulnerability
When national cyber security agencies including our own NCSC sounded the alarm last week over critical vulnerabilities in PHP, it was not routine advisory noise. It was an urgent call to action. PHP is the invisible workhorse powering nearly four out of five websites across the globe, including content management systems like WordPress. What was also interesting was that while this issue has been known for quite a while, it was the latest AI tools that raised the alarm. The vulnerability involves potential unauthenticated remote code execution, meant that any internet-facing server running vulnerable or unpatched code was suddenly in the crosshairs of opportunistic automated scanners and bad actors.
When critical flaws land in software that underpins the digital infrastructure of thousands of organisations, there is no grace period. Either you know your exposure and act, or you become an easy entry point.As an organisation advocating for a digitally capable, secure, and connected New Zealand, we can’t simply preach digital resilience; we have to embody it. Following the alert, an immediate review of our web site revealed an uncomfortably common reality: our website was running on an out-of-date PHP 7.4 instance, anchored by an Enfold WordPress theme (v4.5) dating back to 2018. Because legacy themes and plugins often break when server runtimes jump multiple generations, upgrading wasn’t as trivial as flipping a single switch. It required careful technical unpicking under time pressure.
Thanks to swift work by our team we methodically tackled the issue. We started with full backups of the site to guarantee business continuity before touching the code. We successfully moved the site from unsupported PHP 7.4 to PHP 8.2, bringing the platform onto a supported version and neutralising the immediate exploit risk. PHP 8.2 resolves the immediate emergency, but we need to keep updating it in a careful path to the latest version (8.5) to keep our foundation secure and supported.
It is tempting for non-profits, associations, and smaller businesses to treat websites as digital brochures: build them, launch them, and assume they will look after themselves. But code ages like milk, not wine. The moment a dependency stops receiving security updates, every passing week compounds unseen institutional risk. Our quick turnaround was not an accident of good luck; it was the direct outcome of us looking to build deliberate cyber governance.
Having recently commissioned an independent cyber security audit, we knew that identifying digital assets and knowing where they sit is half the battle. Audits strip away complacency and give management a clear-eyed map of technical debt before an emergency strikes. Equally decisive was our board’s decision to appoint one of our own board members as a virtual Chief Information Security Officer (vCISO).
Cyber risk is no longer an isolated IT operational headache; it is a fundamental governance responsibility. By embedding dedicated vCISO leadership directly into our board oversight, we are insuring that security warnings don’t get trapped in our inboxes.
The PHP warning was a reminder that digital security is not a project with an end date. It is an ongoing discipline of vigilance, proactive maintenance, and leadership accountability. When the next critical advisory lands – and it will – being prepared to act is the only acceptable posture.
