PHP2Shell: how we protected HotelierKit websites
HotelierKit websites were protected before two serious PHP flaws went public on 21 October. Here is what happened, what we did, and why hotels didn't need to do anything.
On 21 October, two serious security flaws in PHP were made public. HotelierKit websites were already protected: Cloudflare, which sits in front of every site we run, had a rule blocking the attack in place that morning. We added our own, stricter block shortly after the announcement, and applied the official fix across the platform shortly after it was released. We found no evidence that the flaws were used against us, and no hotel needed to do anything.
What happened
PHP is the programming language behind a large share of the web, including WordPress and HotelierKit. At 8:34pm Bangkok time on 21 October, the PHP project disclosed two flaws, now known as PHP2Shell. With a specially crafted request, an attacker could run their own code on a web server.
A fix was published the same day. Until a website's host actually installed it, though, that website stayed exposed.
What we did
- 10am, 21 October, before the announcement: Cloudflare, the security network in front of every HotelierKit website, switched on its own rule against the attack. Cloudflare protected its customers hours before the flaws were public.
- Shortly after the announcement: we added our own, stricter block on top. It stops the kind of request the attack relies on altogether. Hotel websites never need that kind of request, so nothing stopped working.
- Shortly after the official fix was released: we applied it across the platform.
- Throughout: we checked our systems for signs of an attack and found none.
Cloudflare's rule only protects a website if every request has to pass through Cloudflare. Ours do, because our servers don't accept traffic from anywhere else. A website that can be reached directly gets no protection from that rule, so it has to wait for its host to install the fix.
What it means for you
Nothing to do. There are no passwords to change, no updates to install and no plugins to check.
On a website you manage yourself, someone has to spot the alert, wait for the host to update and then check every plugin. That can take days, and the site is exposed the whole time. On HotelierKit, it's our job, and it's part of what the platform fee covers.
What we're doing next
Our extra block at the edge stays in place for good. Hotel websites never need the requests it stops, so there is no reason to remove it.
Questions about your website's security?
Security updates, monitoring and protection are part of the HotelierKit platform fee.
