Businesses urged to update websites following critical security flaw
A serious security vulnerability has been identified in PHP, a technology used to run many business websites, online stores, and web services.
If exploited, attackers could potentially take control of affected websites or servers. This could result in websites being taken offline, defaced, used to spread malware, or lead to unauthorised access to business data.
A security update has now been released, and businesses that use PHP are being urged to apply updates as soon as possible.
What this means for your business
If you're not sure whether your website uses PHP, don't worry. Your website developer, IT provider, or hosting company will be able to tell you.
Your business may be affected if:
- Your website was built using PHP.
- You use a content management system (CMS)
- Your website or online services are hosted by a third-party provider that uses PHP.
- You run web applications internally or externally that rely on PHP.
What you should do
Contact your website developer, IT provider, or hosting company and ask whether your website or services are affected. Ask them the following questions:
- Has the latest PHP security update been applied to our website or web services?
- Are any of our systems affected by this vulnerability?
- Have you checked whether any of our systems were compromised before the update was installed?
- Are there any additional updates or actions required to secure our website and services?
- Do customers, staff, or administrators need to reset passwords or other credentials as a precaution?
- If the update cannot be applied immediately, what temporary measures are being taken to reduce the risk?
Ask whether they have checked for signs of unusual activity, such as:
- Unexpected changes to your website.
- New administrator accounts being created.
- Website outages or poor performance.
- Unusual login attempts or activity.
Why it matters
Applying the latest security updates is the best way to protect your website and online services from this vulnerability. However, installing the update will not remove an attacker if a system was already compromised before the patch was applied.
Businesses should seek assurance from their website developer, IT provider, or hosting company that appropriate updates have been applied and that affected systems have been checked for signs of compromise.