The latest PHP security vulnerabilities: what they mean for your Wix website

If you have seen the recent warnings about PHP security vulnerabilities, you may be wondering whether your website is affected and whether you need to do anything.

For businesses with a standard Wix or Wix Studio website, there is no PHP update to install. Wix uses a different technology setup and manages the hosting and core platform security for you.

That is one of the practical benefits of building on Wix. The technical maintenance needed to keep the platform running securely is handled centrally, rather than becoming another job for your business.

So, what has happened with PHP, why is it serious and how does Wix differ? Here is what business owners need to know.

What is PHP, and why does it matter?

PHP is a programming language used to run many websites, including WordPress. It works on the server, the system that processes requests and delivers your website to visitors.

Depending on how a website is built, PHP can help retrieve content, process forms and run features such as online stores or member accounts.

You generally do not see PHP when you visit a website. You see the pages and features it helps produce. That is why a business owner might use a PHP-based website for years without knowing which version it runs or who is responsible for updating it.

When a security flaw is found in PHP itself, the issue can affect the software running the website, even if its pages look normal and its content is up to date.

What are the recent PHP vulnerabilities?

Two critical vulnerabilities, collectively known as PHP2Shell, have been disclosed. Both involve how PHP handles memory while processing website requests. Memory is the temporary working space software uses to carry out tasks.

The first flaw can leave PHP in an unsafe state when it runs out of memory. During cleanup, PHP can then treat invalid information as if it were valid.

The second can leave behind references to information whose memory has already been released. A later request can encounter those references before PHP has properly reset them.

The technical details differ, but the potential result is serious: under exploitable conditions, an attacker can make the affected server run malicious instructions without logging in.

Security reports call this “unauthenticated remote code execution”. In everyday language, someone may be able to send a specially crafted request over the internet and make the server execute code they control.

Why updating a plugin may not fix the problem

These vulnerabilities are in PHP itself, which sits underneath the website software.

For a WordPress website, that means updating WordPress, its theme or its plugins does not, by itself, establish that the PHP problem has been fixed. The hosting environment also needs the relevant security update.

This matters because an attack does not necessarily depend on a mistake in your website's own code. PHP's security team identified a demonstrated attack against one server configuration that could happen before the website's application code even started running.

If you run a PHP-based website, ask your hosting provider to confirm that the fix has been applied to the PHP environment your site actually uses.

Why standard Wix websites are different for PHP

Wix and Wix Studio websites run on Wix's managed platform. Wix does not support installing PHP code directly on your Wix website. For custom server-side functionality, its documented development environment uses Node.js, a different technology.

Based on that documented setup, a standard Wix website does not have the customer PHP environment these particular vulnerabilities target. There is no PHP version for you to upgrade in your Wix dashboard.

There are two separate advantages here. The technology is different, so these specific PHP flaws do not apply to a standard Wix site's own code environment. The platform is also managed, so Wix takes responsibility for maintaining its underlying infrastructure.

That distinction is useful when assessing security headlines. A vulnerability affects particular software and configurations. The relevant question is whether your website uses the affected technology.

What Wix's managed ecosystem means for your business

With Wix, your website builder, hosting and core platform security operate within one managed service. You do not need to arrange separate server maintenance or coordinate a PHP upgrade with a hosting company.

Wix's published security measures include:

• 24/7 security monitoring: dedicated teams monitor the platform for threats and suspicious activity.

• Vulnerability scanning and testing: Wix checks its infrastructure and software for weaknesses, including through penetration testing and independent security research.

• Encrypted connections: automatic SSL certificates support HTTPS, helping protect information travelling between visitors and your website.

• Protection against disruptive traffic: Wix maintains measures to reduce the impact of attacks designed to overwhelm its services.

These protections are part of the platform. They do not depend on a business owner remembering to install a separate security plugin.

For your business, the benefit is less technical maintenance to organise and a clear provider responsible for the core infrastructure. Your time can go into your customers, your services and how well your website supports them.

Does that mean Wix can never have a security issue?

No platform can make that promise. Every online service needs ongoing security work as new threats emerge.

Wix's advantage is that this work is managed at platform level. Its security teams maintain and assess the infrastructure used to deliver your website.

You still control some important parts of your own setup, particularly who can access your account and what they can do once they are signed in.

For Wix owners, the most useful steps are straightforward:

• Use a strong, unique password and enable two-step verification.

• Give team members their own collaborator access with appropriate permissions.

• Remove access when someone no longer needs it.

• Check unexpected messages through your Wix account before following requests to sign in or make a payment.

Wix provides account security settings and collaborator roles to help you manage this access.

What if your Wix website connects to other systems?

A Wix website can connect to services hosted elsewhere. Those services have their own technology and security responsibilities.

For example, if your site links to a separately hosted client portal built with PHP, that portal still needs its provider to check the PHP vulnerabilities. The same applies to a custom integration that relies on an external PHP application.

Using Wix does not remove the need to maintain systems hosted outside Wix. It does mean you can distinguish between the website platform Wix manages and the additional services your business has chosen to connect.

What should you do now?

If your website is built and hosted on Wix or Wix Studio: there is no PHP patch for you to install on the Wix site itself. Keep your account access secure and check with the provider of any separate PHP-based systems you use.

If your website runs on PHP: contact your hosting provider or the person responsible for its server. Ask them to confirm that the PHP2Shell fixes have been applied. Australia's ACSC also recommends monitoring affected applications and related systems for suspicious activity.

A vulnerability being announced does not mean every website using that technology has been hacked. It does mean the people responsible for affected systems need to act.

A website that supports your business, with less to manage

Your website should help people understand your business, trust your expertise and take the next step. The platform behind it should support that work with dependable infrastructure and ongoing security management.

That is part of the value of Wix. Alongside the design and business tools, you have a managed platform with security expertise behind it.

At Miss Wix, we design and develop Wix Studio websites around your business, your customers and what you want to achieve. From new websites to rebuilds and custom functionality, we bring every part together to help your website work better for your business.

Planning a new website or a move to Wix Studio? Let's talk about what your business needs.