On the evening of Oct. 21, cyber experts wrestled with two critical flaws in certain versions of PHP, the programming language that powers WordPress and much of the web. The flaws could let attackers run malicious code and take control of affected servers. Alarming headlines followed quickly.
Within minutes of the first alert, Vendilli developers, leadership, account managers and content team were working together on a plan. By the next morning, more than 250 potentially affected clients had an email from us explaining what happened, what it meant for them and what we were doing about it. We wanted them to hear it from us first.
What we did overnight
The good news: The threat turned out to be far less damaging than many pundits feared for websites generally, and none of the client sites we host were compromised.
That outcome reflected preparation that started a year ago, when we updated our servers to make sure they could run the latest versions of PHP. We also proactively moved all of our hosted sites to use PHP 82 or PHP 8.3 (the vulnerability affected versions prior to those).
When the PHP vulnerabilities were announced, our hosting servers were already running a security package that was actively being updated to block common variants of the exploit. Within hours of the alert, our team installed the patched version of PHP on our servers, made sure that all hosted sites were running on patched versions of PHP, and removed older PHP versions entirely. We confirmed that sites with special requirements, such as e-commerce payment processing, kept working after the update. Then we reviewed our server logs to confirm that no site had been exploited.
Clients whose sites run on Studio V or HubSpot got a simpler answer: Those platforms don’t use PHP, so they weren’t affected.
This won’t be the last vulnerability that affects website owners. So we intend to be ready for the next one.
Stewardship means seeing the next risk coming
Responding fast to a crisis matters. Spotting a risk before it becomes one matters even more. Right now, one of the fastest-growing risks for website owners isn’t a hack at all. It’s a demand letter.
Plaintiffs’ attorneys have been sending demand letters, some as high as $50,000, to businesses whose websites use tracking tools like Meta Pixel, LinkedIn Tag or Google Analytics without proper cookie consent.
Many of these letters cite the California Invasion of Privacy Act, which applies to any website California residents can visit, no matter where the business is located. Even pixels left over from old ad campaigns can draw a letter. We covered this in more detail in our earlier post on tracking pixel lawsuits.
A quick check for any website owner: Does your site use tracking tools? If so, do visitors have to opt in before those tools load? And has your privacy policy been updated for the state privacy laws that took effect this past year? If you’re not sure, it’s worth finding out.
For our clients, we address this with Termageddon, a platform we partner with. It provides auto-updating privacy policies and a consent banner that blocks tracking until visitors opt in, and its policies update as new state laws take effect. We handle the setup.
Accessibility: the risk hiding in plain sight
Another issue that we think about – and that many website owners have not considered – is website accessibility, especially for sites built years ago. A site that people with disabilities can’t use shuts out potential customers and can leave its owner exposed to ADA compliance claims.
The problems are often invisible to the people who manage the site. On one recent client project, an audit flagged more than 70 issues: buttons with no labels for screen readers, images described only by file names, data tables without headers, yellow text too faint to read against white and links distinguished by color alone.
A quick check for any website owner: Can you move through your site using only the Tab key? Do your images have descriptions a screen reader can announce? Is any text hard to read against its background? If you’re not sure, a free tool like WAVE can flag common issues in a few minutes.
Our process starts with a developer audit of every flagged issue. We make each fix on a staging site, verify it against the original findings and deliver a plain-language report before anything goes live. The goal is compliance with WCAG 2.2 AA, the current accessibility standard.
Questions about your website? Let’s talk
Website stewardship starts with good design, functionality and user experience, but it doesn’t end there. Whoever manages your site should also be making sure what’s under the hood is street legal and protected from cyber threats.
If you’d like a second set of eyes to assess where your website stands on security, privacy compliance or accessibility, reach out to John Caruso at john@vendilli.com.
To our clients: Thank you for trusting us with your websites and your marketing. Being good stewards of that trust is the job, any time, even at 10 p.m. on a Wednesday.
