On October 21, PHP released emergency security patches for two critical vulnerabilities that security researchers are calling “PHP2Shell.” Both are rated 9.2 out of 10 for severity and could let an attacker take control of a website remotely.
Every version of PHP released in the last decade is affected, and PHP powers most of the websites in the world, including every WordPress site. Hackers were already trying to use these flaws before the fix came out, and several government agencies, including Australia’s own cybersecurity agency, took their websites offline as a precaution while they patched.
The good news is that most of the large hosting companies, including WP Engine, HostGator and Bluehost, have already rolled out the patches, so the servers your website lives on should now be secure.
If you have a Shopify or Wix website
If you have a Shopify or Wix website, no worries for you on this one. Those platforms manage their own servers, so your store or site is safe, and you can keep rolling out those Black Friday sales!
The only thing to double-check is anything connected to your site that’s hosted somewhere else, like a custom app or a WordPress blog. If you have one of those, let us take a look. And testing your contact forms periodically is always a good idea no matter the platform.
For WordPress sites
For WordPress sites, the catch is that these updates can cause problems if you’re running an outdated theme or plugins. Older code doesn’t always play nicely with newer versions of PHP, and when something breaks, it isn’t always obvious right away.
Here’s what I recommend:
- Take a good look at your website. Click through your pages and watch for anything that looks broken, like missing sections, strange formatting, or bits of code showing up on the page.
- Test all of your contact forms. Forms were one of the vulnerable areas, so fill each one out yourself and make sure the message actually lands in your inbox.
- Let us take a closer look. We can do a more thorough update of your WordPress software, theme and plugins, and let you know if it looks like your site has been hacked or has any malware issues.
We’ve also been blocking international traffic
We’ve also been blocking international traffic for clients who don’t need it for their business. It’s a simple way to cut down on the more obvious bot attacks, and if your customers are all here in the U.S., it’s worth considering.
If you’re hosted with WP Engine
If you’re hosted with WP Engine, here’s what they’re telling customers: they’ve patched two critical PHP vulnerabilities on their platform, so no action is needed on the server side.
They’re also running critical WordPress security updates for sites on version 4.7 or later. Those can’t be deferred, and WP Engine recommends upgrading to the most secure version of WordPress now rather than waiting for them to do it.
We know you’re busy
We know you’re busy, so we’ll keep this as simple as possible. I’m happy to schedule a call to talk through your site, or you can send me a quick email or text, whatever works easiest for you.
My team will work through these updates with sites that have active security issues (like malware attacking your site) first, and then on a first come, first served basis. There are only so many hours in the day, so the sooner you reach out, the better.
Even without a big announcement like this one, it’s a good idea to check your website software periodically. I typically recommend quarterly updates for my clients to make sure everything stays current. Hacking has become part of everyday business, and staying up to date is the easiest way to stay ahead of it.
Talk Soon!
– Angela
(303) 667-9821
