On Wednesday 21 October, a pair of critical security flaws in PHP forced websites around the world offline, including ours. Here's what happened, what it means for your agency, and what to check now.

The short version

What happened: two critical flaws were found in PHP, software that runs behind a large part of the web. To keep client websites safe, we took our platform offline from around 1pm to 8pm while we waited for the fix and applied it. Our checks have found no evidence that any client website was compromised.

If you're an Estate Apps client: follow up any missed calls or messages from Wednesday afternoon, test your website forms, and check your latest listings are showing. Details below.

Whoever runs your website: this won't be the last day like this. There are five questions worth putting to your provider now, before the next one.

It started with chatter on Tuesday night

On Tuesday, the PHP security team gave advance notice of an emergency fix for two critical vulnerabilities, and details were already leaking ahead of schedule. Around midnight on Tuesday, we picked up the chatter online and started monitoring straight away.

By Wednesday, every web team running PHP was facing the same uncomfortable question. We were one of them.

What actually happened

PHP is a programming language that does a lot of quiet work behind websites, every time a page loads or a form is submitted. CNBC reports that it's used by just under 70% of websites whose server-side language is known.

The two flaws, nicknamed PHP2Shell, were each rated 9.2 out of 10 for severity. In the worst case, they could let an attacker run their own code on a web server without logging in. The fixes were published at 3pm UK time on Wednesday.

Until then, cybersecurity agencies in Britain, Europe and beyond urged organisations to update immediately or take websites offline. Government websites across Europe went dark, and the story made national news in the UK.

Vulnerability, attack, breach: three different things

• A vulnerability is a weakness that could be exploited.
• An attack is an attempt to exploit it.
• A breach is when an attacker has actually got in.

A website going offline during a security incident is very often a precaution, not a sign that anything has been compromised.

Our checks have found no evidence that any client website was compromised.

Our Wednesday, in three stages

We build and run our own website platform for independent estate and letting agents, and PHP is part of it. The choice in front of us was simple to describe and hard to make: keep sites running while a serious risk stayed open, or take the hit and close the gap properly.

1pm: the decision

With details already circulating and the fix still two hours away, we took the entire platform offline as a precaution. Leaving sites exposed while we waited felt like the bigger risk, and going offline was the surest way to protect your website and the information behind it.

3pm to 6pm: the wait

The official fix was published at 3pm, but a fix being released and a fix being ready to install aren't the same thing. Updates filter out gradually through the providers that package them, and ours didn't arrive until around 6pm. Those three hours were the hardest part of the day: we knew exactly what needed doing, and we couldn't do it yet.

6pm to 8pm: patch and restore

As soon as the updates landed, we patched everything we needed to. At around 8pm, we sent the message we'd been waiting all day to write: we're back online.

That was around seven hours offline in the middle of a working day. For an agent, that's seven hours in which a seller might have tried to book a valuation, or a landlord might have gone looking for someone to manage their property. We're sorry for the disruption it caused, and we don't take it lightly.

But putting sites back up before they were patched wasn't an option. A fast restore that leaves the door open isn't really a restore. Checks on integrations and loose ends carried on into Thursday.

What we could control: keeping you in the loop

An agent with a website down wants four answers. Do you know about it? Is my data safe? When will it be back? Do I need to do anything?

So we sent notifications to all our clients, and anyone who emailed our support inbox got updates back as regularly as we could manage. That included the updates nobody enjoys sending: "we're still working on it and we don't have a reliable time yet".

We'd rather say that than invent a reassuring answer. An accurate picture lets you brief your team, warn vendors and landlords, and push enquiries to the phone. A made-up timeline doesn't. It's the same reason we care so much about fast, friendly support, and why we're wary of support that hides behind automation.

Then came the messages we weren't expecting

By Wednesday evening the team was running on fumes. Then a few messages landed.

Martyn Baum sent this the next morning:

"Well done for yesterday... sounds like a nightmare... very pleased to have you and your team looking after us!"

Martyn Baum

And Emma Todd, when we confirmed sites were back:

"Thank god and well done guys"

"What a day for you!"

Emma Todd

Emma also suggested that 500 beers might be in order. My reply was two words: "Nope, sleep!" I wasn't joking. 😂

Those messages meant a lot, precisely because the day hadn't gone perfectly. Our clients had been disrupted, and still they took a moment out of their own busy day to check in. That kindness works both ways, and we don't take it for granted.

If you're an Estate Apps client: three quick checks

Our team has been working through checks on the platform and its integrations since Wednesday evening, but nobody knows your site and your enquiries like you do. These take ten minutes:

1. Follow up Wednesday afternoon. While the platform was offline, from around 1pm to 8pm on 21 October, your website couldn't be reached. Anyone who tried to get in touch may have phoned, emailed or gone through the portals instead, or simply given up. If you haven't already, check missed calls and messages from that window and follow them up.

2. Test your forms. Submit a valuation request and a viewing request yourself, and check they reach your inbox and your CRM.

3. Check your listings. Make sure your latest properties and status changes are showing on your site as you'd expect.

If anything looks off, get in touch and we'll look at it straight away.

Why this matters beyond Wednesday

PHP2Shell wasn't stumbled on by a lone hacker. It was found by security researchers using AI, and the detail that stuck with us is that the weakness wasn't new. According to SecurityWeek, part of it was first spotted in 2020 and again in 2024, but it was never patched because nobody could prove it could actually be exploited. AI changed that.

Three things follow, and each one affects your agency:

1. More urgent fixes are coming. Old code across the internet is being looked at again with these tools. SecurityWeek reports that, according to the PHP Foundation, AI has helped surface more PHP vulnerabilities than before, with 15 new ones published since 1 July.

2. There will be less time to respond. This time, details leaked online before the planned release, and exploitation attempts were reported before the flaws were even public. Patch day used to be the starting gun. Increasingly, it's the deadline.

3. One flaw can hit everything at once. Your website, CRM, portal feeds and marketing tools look like separate products, but many share the same foundations underneath. When something that widespread needs fixing, thousands of unrelated businesses get the same bad day together.

What that means in practice: the speed and clarity of whoever looks after your technology matters more than ever. It's one of the quieter advantages of a platform that's built and maintained in one place: a fix can be applied across every site at once, rather than chased site by site.

Five questions to ask your website provider

You shouldn't need to know what PHP is to run an estate agency. But whoever looks after your website, it's worth knowing the answers to these before the next incident, not during it:

1. Who applies urgent security updates, and how fast? If your site is self-managed, for example WordPress with separate hosting, check who's actually responsible for patching. Sometimes the answer is nobody.

2. How will I hear about an incident? Email, phone, a status page? And will it come from a person who understands your business?

3. What will visitors see while the site is down? A holding page with your phone number keeps enquiries coming in. A blank or error page just sends people somewhere else. We learned this one the hard way on Wednesday.

4. How are integrations checked afterwards? Portal feeds, CRM syncs and lead forms don't always recover at the same time.

5. What changes afterwards? Does your provider review the cause and tell you what they're doing differently?

And if your website does go down

• Point people to the phone. A quick post on your Google Business Profile and social channels with your number keeps enquiries coming.
• Watch your portal inbox. Portal enquiries don't depend on your own website, so they keep arriving even while it's offline.
• Tell whoever answers the phone. If they know the website is down, callers get a confident answer instead of a surprised one.
• Test and follow up once it's back. The three client checks above work for any agency, whoever runs your website.

Comparing providers more widely? Our practical guide to comparing estate agent website providers covers the rest of the checklist.

What we're taking away

Days like this should change things, and one lesson stood out straight away. While the platform was offline on Wednesday, visitors to your website didn't see a holding page with your phone number on it. They just couldn't reach the site. That's on us, and putting a proper holding page in place across the platform is now one of our priorities, so if a site ever has to come offline again, your visitors still know how to reach you.

The bigger lesson is a simple one. Technology keeps getting cleverer, but relying on it is still a very human experience. When it goes wrong, people want three things: the truth, regular updates, and confidence that someone capable has hold of the problem. That won't change, however advanced the tools get.

A final thank you

To everyone who was patient, checked in or sent a kind word: thank you. And to our team, who stayed with it until everything was back: thank you too.

No supplier can promise there will never be another difficult Wednesday. What we can promise is to keep learning, keep improving and keep telling you straight when something's wrong.

Now, if you'll excuse us, we're hoping for a much quieter few days.

Alex, on behalf of a slightly sleep-deprived Estate Apps team

Could your website cope with a day like Wednesday?

Put the five questions above to your current provider. If the answers aren't clear, talk to us and we'll walk you through how we handle security updates, outages and enquiries. You can also see what agents say about working with us or browse our client case studies.

Estate Apps builds websites and marketing technology exclusively for independent estate and letting agents, combining our own platform with genuinely personal support