Many websites need an urgent security fix. Here is what to do

CERT-EU says proof-of-concept code is circulating and warns that exploitation is more likely. Its advisory also says products that embed PHP may be affected, so a website owner needs to check more than the software visible on the home page.

If you have online accounts

Start with your email account, then banking, shopping and any account with a saved card. Change reused passwords, especially on smaller sites, and give each account a unique password stored in a password manager. Turn on two-step login; choose an authenticator app over text messages when the service offers one. These steps protect your accounts even when you cannot control a website's server.

Watch card statements over the next few weeks. Be careful when entering passwords or card numbers on small or unfamiliar websites, and treat unexpected “maintenance,” “security update” or password-reset emails and texts as suspicious. Open the service directly instead of following a message link. Keep your phone, computer and browser updated, too.

If you run a website

PHP says updating is the only complete fix. Ask your host or developer today whether the site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a distribution package that contains the corresponding patch. If it uses PHP 8.1 or older, ask about moving to a supported version or a supported vendor backport. Update WordPress and its plugins as part of normal site maintenance, but do not mistake a plugin update for a PHP server patch.

The FBI Cyber Division urges organizations to inventory PHP, including products that bundle it, update immediately, and take systems offline if they cannot update. Its guidance says to watch for PHP processes starting command shells or downloading files and to report suspected compromises through ic3.gov or an FBI field office. NSA Cyber also advises taking an unpatched system offline if an immediate update is not feasible; it warns that these flaws can provide a route to a server's files or database.

Our systems and the next check

A Comal.News check of its own systems found its servers, sites and newsletter do not use PHP, and that the day's security updates were installed.

For site owners, the next useful record is a confirmation from the host or developer naming the installed PHP package and patch. Readers can inspect the PHP release notice for the fixed versions; later PHP and CERT-EU advisories are the records to watch for changes in remediation or verified attack reports.