Update, Wednesday 21 October, 4pm UK time: the update is installed and everything is running normally. The PHP team published the fixed versions this afternoon, and our servers were running them by 3:45pm. The restart itself took a few seconds, and we have seen no problems since. Nothing needs doing on your side. The original post follows below, unchanged apart from the notes marked as updates.
If BookingNinja is slow or briefly unavailable at some point today, this is the reason. We're applying an urgent security update to the software our servers run on, and we'd rather tell you now than have you find out mid-service.
What's happening
Yesterday evening (20 October), the team behind PHP gave advance notice of an emergency security release. PHP is the programming language that BookingNinja, and a very large part of the internet, is built on. The release fixes two critical vulnerabilities and is scheduled for today, Wednesday 21 October, at 14:00 UTC (3pm UK time).
As soon as it's out, we'll install it across our servers. That means a short maintenance window this afternoon or early evening.
How long it will take
We aim for it to be a matter of minutes. In most cases you won't notice anything beyond a page that takes a moment longer to load.
Because this update changes the core software every request passes through, rather than a feature sitting on top of it, we can't rule out a longer interruption. Please allow up to half an hour during which BookingNinja, including your booking pages and the staff app, may be slow or unavailable. Bookings that were already confirmed are safe; nothing is lost while the servers restart.
If you have a busy service this afternoon, it's worth keeping your bookings list open in a browser tab, or printing today's sheet, so you have it to hand if there's a gap.
Why this is urgent
PHP isn't a niche tool. W3Techs, which tracks the technology behind websites, reports that PHP is used by 69.3% of all websites whose server-side language it can identify. WordPress runs on it, as do countless online shops and booking systems.
Both vulnerabilities are rated 9.2 out of 10 on CVSS, the standard scale the security industry uses to score how serious a flaw is. Scores that high are reserved for problems that could let an attacker take control of a server from the outside, without needing a password. The EU's cybersecurity response team, CERT-EU, has issued its own advisory telling organisations to prepare for immediate patching.
This is rare. Security fixes for PHP come out routinely, but a pre-announced emergency release for two flaws rated this highly is not something we see often. The PHP team has deliberately held back the technical details until the fix is available, and has said it will release early if details leak or if the flaws start being exploited. That's exactly why we're moving today rather than at our next planned maintenance.
We have no indication that anyone has tried to use these flaws against BookingNinja. This is us acting before there's a problem, not after one.
Between now and the fix
We haven't waited for the release to start protecting things. Since this morning we've had temporary safeguards in place on our servers, and they come with some side effects until the official patch is installed:
- You may see more automated security checks. Occasionally you or your guests may be asked to wait a moment, or confirm you're not a robot, before a page loads.
- Some file uploads may fail. Anything that involves uploading a file, such as adding an image to a session or your website, may not work for the time being. If an upload fails, please try again after the maintenance rather than repeatedly in the meantime.
Taking bookings and payments is not affected by these safeguards.
Once the update is installed and we're satisfied it's working, we'll remove the temporary measures and everything goes back to normal. We'll update this post when that's done.
Update: the patch is installed and we've removed the temporary safeguards from our servers. If an upload failed earlier today, please try it once more, and tell us if it still doesn't work.
If you run your own website
Many of you have a website of your own alongside your BookingNinja pages, often on WordPress or something similar. If that site runs on PHP, it's affected by the same vulnerabilities, and it's your hosting provider who needs to apply the update.
Most good hosts will do this automatically and quickly. It's still worth checking. A short email to your host or web developer asking "Are you applying the PHP security release from 21 October, and when?" is enough. If you manage your own server, plan to upgrade PHP as soon as the fixed versions are published this afternoon.
Update: the fixed versions are out. They are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and they are listed on php.net. If your host tells you which version your site runs, that's the number to check. PHP 8.1 and older get no fix from the PHP project, so a site still on one of those needs upgrading to a supported version.
If your website is hosted on BookingNinja, you don't need to do anything. It's covered by our update.
Support today
While our team works through the update and keeps an eye on everything afterwards, replies from support may be slower than usual today. We'll still be reading every message, and anything urgent that's stopping you taking bookings will be looked at first.
If something isn't working after the maintenance window has finished, let us know: the more detail the better, including the page you were on and roughly what time it happened.
Thank you for bearing with us. If you have any questions about the update or what it means for your venue, just reply or get in touch.