You may have seen the headlines this week: AI found a serious security hole in the technology behind about 70% of the world's websites, hackers started using it within hours, and governments told website owners to fix it right away or take their sites offline. Here's what happened, in plain words, and why Ella customers have nothing to worry about.
What happened
Most websites are built with a handful of common tools. One of the oldest and most popular is PHP. It runs WordPress sites, online shops and many older business systems. On Wednesday, October 21, security researchers announced that, with the help of AI, they had found two serious holes in PHP that had gone unnoticed for more than a decade. The security world calls them PHP2Shell.
In plain terms: on a website that hasn't been fixed yet, a hacker can take over the computer that runs the site and get to the information behind it. The people who maintain PHP released an emergency fix the same day and asked everyone using PHP to install it immediately. The US National Security Agency told organizations that can't patch right away to take their systems offline, and cyber-security agencies in the UK, the EU, Singapore and Australia issued similar warnings.
Attackers moved fast. Cloudflare reported millions of attempts to exploit the flaws within hours of the announcement, and Amazon said it saw attempts days before the details were public. Government sites, universities and councils took pages offline while they patched.
Why Ella TMS is not affected
The hole is in PHP itself, so it can only hit systems built with PHP. Ella TMS isn't built with PHP anywhere: not in the TMS your office works in, not on the servers behind it, and not in the driver app. We've checked every Ella system.
- No patch to install and no downtime for your team.
- Your data was not exposed through this flaw.
- Nothing for you to do in Ella. If you get an email claiming you must "urgently patch Ella" or reset your Ella password because of PHP2Shell, it didn't come from us.
We don't publish the technical details of how Ella is built or hosted. That's deliberate: the less an attacker knows about a system, the harder it is to target.
What trucking companies should check this week
Your TMS may be safe, but PHP is everywhere. Take 15 minutes to check the rest of your business:
- Your company website. If it's built on WordPress or hosted on a typical web host, it almost certainly runs on PHP. Ask your host or web developer whether the PHP security fixes have been applied. Updating WordPress or its plugins does not fix this; PHP itself has to be updated.
- Other web systems you log into. Customer portals, older web-based software, recruiting sites or anything built years ago may run on PHP. Ask each vendor whether they're affected and patched.
- Phishing. Criminals use big news to send fake "security alert" emails. Don't click links asking you to log in or reset a password; go to the site directly instead.
- Passwords. If a service tells you it was affected, change that password, and change it anywhere else you used the same one.
- Two-step sign-in. Turn it on for email, banking, factoring and load boards if you haven't already.
How Ella keeps your data safe, now and in the future
PHP2Shell is a reminder that software built years ago can carry hidden risks, and that AI now helps attackers find them faster. Here's how we protect Ella customers:
- Your own private system and database. Your data is never mixed with another company's, so a problem somewhere else doesn't become your problem.
- Independent security testing. Every system goes through third-party QA and security testing by CoreTest Solutions before it's handed over.
- Audited hosting with daily backups. Our hosting providers are independently audited to SOC 2 Type II, and backups run automatically every day.
- Role-based permissions and secure logins. Each employee sees only what their job needs, accounts lock after repeated failed sign-ins, and an activity log records who changed what.
- Encrypted connections between your team, your drivers and the TMS.
- Email Security (part of the Gmail Suite add-on) alerts you when someone may have broken into a company mailbox, the usual start of double brokering and payment fraud.
- We watch for alerts like this one. When a major security issue is announced, we check every customer system and tell you whether you're affected and what we did about it.
Questions about security, or about moving off an older system? Talk to us, or read how Ella handles AI and your data.
Frequently asked questions
Is Ella TMS affected by the PHP2Shell vulnerability?
No. Ella TMS doesn't use PHP anywhere, including the TMS, the servers behind it and the driver app, so PHP2Shell can't affect it. There's nothing for customers to patch or do.
Do I need to change my Ella password because of PHP2Shell?
No. Your Ella account wasn't exposed by this flaw. Be careful with emails that say otherwise; they may be phishing.
Is my company website at risk?
If it runs on WordPress or another PHP system, it may be. Ask your host or web developer to confirm PHP has been updated. Updating WordPress or plugins alone doesn't fix PHP2Shell.
My current TMS is web-based. Could it be affected?
Only if it runs on PHP. Ask your TMS vendor directly whether they use PHP and whether the fixes are applied.