Why governments said "go offline"
The U.S. National Security Agency told organizations to update right away, and to take a system offline if they could not update it yet. The European Union's cyber team and the UK's cyber centre said much the same.
Attackers are already moving. Cloudflare's chief technology officer said the company was seeing early attacks. Website security firm Patchstack said it had reports of the flaws being used. The flaws were found by AI, through an OpenAI program for security companies, and the same kind of tool helps attackers move fast.
Tell your staff
If a customer portal or vendor site you use is down this week "for security updates", that is the right call, not a red flag. Do not go looking for a workaround or an unofficial copy of the site.
Is your website affected?
If your site runs on WordPress, or on a hosting plan with cPanel, it almost certainly uses PHP. Whether it is exposed depends on whether your host has installed the update yet.
Many hosting companies patch this for you. Many do not, or only patch the newest plans. The only way to know is to ask.
- Ask whoever runs your website: does our site use PHP, and is it on a fixed version yet?
- Ask your hosting company the same question, in writing.
- Turn off old sites, test sites and forgotten WordPress installs you no longer use.
- Check that your website backups are recent and stored somewhere other than the same server.
Tell your staff
Website logins and hosting passwords are not shared by email or text. If someone asks you for them "to install the PHP fix", call them back on a number you already have.
The short version
Most small business websites run on PHP. A fix is out. Make sure your site has it, today, not next month.
If you are not sure who looks after your website, or you want us to check it for you, get in touch.