The recently disclosed “PHP2Shell” security vulnerabilities have placed significant pressure on operators of PHP-based websites to take action. Security updates are available - but, especially in the case of older applications, these cannot always be installed without complications.
At the same time, this incident highlights a broader trend: AI is assisting security researchers in uncovering long-standing vulnerabilities and executing complex attack chains.
This raises a question that extends well beyond the immediate need for an emergency patch: Can the maintenance of web systems keep pace with this development?
An Available Patch does not Solve every Problem
PHP has released security updates for its supported version branches, 8.2 through 8.5. Older installations must rely on backported security fixes provided by their vendors, custom source code modifications, or a full version upgrade. As an exception, minimal source code backports have been made available for PHP 7.4, 8.0, and 8.1.
For enterprises, however, a practical challenge remains: switching to a new version may necessitate adjustments to the application, its extensions, and its interfaces - not to mention the need for testing and planning a secure transition.
In the interim, it may become necessary to restrict access or temporarily shut down specific services. Consequently, a security incident can quickly evolve into an unplanned modernisation project - impacting system availability, ongoing operations, and costs.
AI is Changing the Conditions
According to Wiz Research, the AI assisted the research team in analysing vulnerabilities, as well as in developing and adapting functional exploits. This made it easier to overcome the complexity that had previously hindered exploitation.
In this way, AI supports defense. However, the same capabilities can also assist attackers in analysing vulnerabilities more quickly and preparing attacks.
This leads to an important implication for the system architecture: The fewer unnecessary components that are publicly accessible, the fewer such components need to be secured against new attack vectors.
See also:
Which components does a website actually need in order to fulfill its purpose?
Does every Website have to Generate Content Anew each Time it is Accessed?
Many corporate websites, blogs, and documentation portals are powered by WordPress, Joomla, or Drupal. These systems offer convenient content management. However, their traditional architecture generates web pages dynamically: when a page is accessed, PHP processes the request, retrieves content from the database, and assembles the page accordingly.
While caching can bypass this process for many requests, the underlying PHP and CMS installation remains, requiring ongoing maintenance and security updates - along with all its associated extensions.
For websites where content changes primarily through editorial updates, it is worth asking:
Why continue to generate pages dynamically if the content has not changed since it was last published?
An alternative approach is to create the pages at the time of publication. Tools like Astro generate ready-made HTML, CSS, and JavaScript files, which are then delivered directly. Neither PHP execution nor database queries are required for accessing these pages.
The convenience of content management is preserved, however: by using a decoupled CMS, such as Soveri Content editors can create, edit, and publish content. The public-facing website then serves the pages generated from this content.
Additional features - such as forms, search functionality, or restricted areas - can be integrated as needed. For large-scale online stores, member portals, or highly personalised applications, it is necessary to carefully evaluate which architecture best aligns with the specific requirements.
The Internet Computer as a Hosting Alternative
The Internet Computer (ICP) can host websites and applications directly via so-called “canisters”. These execute WebAssembly code and are capable of managing content, application logic, and data - eliminating the need for traditional, separate web server or database installations.
For pre-generated web pages, this approach offers concrete advantages:
- No public PHP runtime: The published files are served without any PHP processing. Consequently, the relevant PHP component is entirely absent from this delivery path.
- Cryptographically verifiable content: Certified responses allow a verifying HTTP gateway to check whether the delivered content matches the state confirmed by the canister.
- Fewer self-managed server components: This deployment model eliminates the need to manage a dedicated PHP environment or a traditional web server installation.
While other static hosting approaches can also avoid a public PHP runtime, the Internet Computer Protocol (ICP) enhances this model through its decentralised architecture and certified content delivery.
Already in Use: Our Own Websites
We are already applying this approach ourselves: Our websites, including samlinux.at and soveri.at, run on the Internet Computer. In doing so, we combine websites built with Astro with decentralised hosting on the Internet Computer.
Furthermore, with Soveri Content, we offer a content management system that allows users to create, edit, and publish content via an editorial interface - much like what one is accustomed to with WordPress.
The difference lies in the architecture: Content management and the public-facing website are kept separate. The published pages are pre-generated and hosted on the Internet Computer.
This ensures that the website remains easy for editors to maintain, while its public delivery requires no PHP runtime.
Review the Architecture Now
ICP (Internet Computer Protocol) applications also require secure programming, careful permissions management, and well-maintained dependencies. While the responsibility for security remains, the components involved - and the risks associated with them - change.
For affected PHP systems, securing the environment is now the top priority. Furthermore, the “PHP2Shell” issue provides a timely opportunity to re-evaluate existing architectural decisions.
As AI accelerates the discovery of vulnerabilities, the deliberate reduction of attack surfaces becomes increasingly important.
With Soveri Content and the Internet Computer, we offer a practical way to combine convenient content management with a different approach to website hosting.
Is this approach right for your website? We are here to assist you with an assessment and a potential transition.
