A quick word about the PHP security news

Over the past few days you may have seen some worrying headlines about a security problem in something called PHP. There has been talk of it affecting a large part of the web, and some sites have gone offline for a while to put things right. A few of you have got in touch to ask whether it affects your details with us, and it is a very fair thing to ask. Our site is not affected, but we thought it was worth going into more detail and to explain why it's safe shopping at Creme de Vape.

First, what PHP actually is. It is one of the common coding languages that runs websites behind the scenes. A lot of the web is using it, from blogs and forums to some very big shop platforms, so when a flaw turns up, the news travels fast and wide. That is really why this has made such a noise. It is not that PHP is uniquely fragile, it is just so widely used that any problem touches a great many sites at once.

The issue this time is a serious one, the sort that could let someone get into a server that has not been kept up to date. If you picture a particular type of lock that has been found to have a weakness, then anyone whose door uses that lock will want to see to it quickly. Anyone whose door does not use it has a little less to worry about.

That is where we come in, or rather where we do not. Our shop is not built on PHP. It runs on an established platform that is looked after and kept current, so this particular problem is not one that applies to us. Your account and your order history are not sitting on the kind of system these headlines are about.

I do not want to overstate it, mind. Nobody who runs anything online should ever promise you that they are completely safe, and I would not insult you by trying. Keeping things secure is an ongoing job rather than a box you tick once, and we treat it that way. All I am really saying is that this specific scare, the one in the news this week, is not one that reaches us. And the most sensitive part, your card details, are handled by a dedicated payment provider rather than kept on our side, which is as it should be.

So if the headlines gave you a moment's unease, I hope this settles it. There is nothing you need to do, and nothing to worry about at our end. As always, if anything ever gives you pause, just drop us a line and you will hear back from a real person who is happy to help.

-Keith