Most of you should now be aware of the global PHP incident discovered by A.I. (or did they escape and create it?).
Here is some welcome advice from Malwarebytes I received this morning for both website visitors and website maintainers and users of hosting companies:
" Breaking news
Critical PHP flaws: What to watch for and what to update
Hello Malwarebytes Customer,
Emergency security updates are now available for two critical vulnerabilities in PHP, the programming language that powers many websites and web applications.
Known as PHP2Shell, these flaws could let attackers run malicious code on an affected server without logging in. They could steal business data, change website content, or use a trusted website to target visitors with phishing pages and malicious downloads.
If you’re a website visitor:
-
Some websites may temporarily go offline while they are patched.
-
Watch for unexpected content, downloads, or redirects, and repeated login requests, even on familiar sites.
-
If something looks wrong, leave the page.
-
You don't need to install PHP
updates on your own device.
If you’re a website owner:
-
Ask your hosting or IT provider to confirm PHP fixes are installed, not just scheduled, across all your websites and applications.
-
If they can’t patch immediately, ask whether affected services should temporarily be taken offline.
-
If you manage your own servers, follow PHP’s update instructions.
-
Using unsupported PHP? Check for a vendor fix or upgrade to a supported version.
[Read our blog for more information about PHP2Shell and the security updates. (PHP2Shell: Why websites are going offline for emergency security updates | Malwarebytes)]
Stay safe,
The Malwarebytes Team.