The issue affects back-end website and web development processes that will be invisible to many users – meaning most people won’t need to take any action.
But small businesses with sites, including those built using WordPress, may be wondering how to protect themselves.
Those who own websites or manage infrastructure running PHP have been urged to secure their websites by updating to the latest version.
Ethical hacker Ken Munro, who has spent years finding security flaws in computer systems, says installing the fixes – known as patching – is “a bit like running a Windows update”.
If a hosting company or web developer manages your website, contact them and ask whether the PHP security fixes have been applied – something that must be applied to PHP itself and cannot be resolved by updating WordPress or its plugins.
If you look after your website yourself, Munro says “it is your own responsibility to make sure fixes are applied”.
The UK’s National Cyber Security Centre recommends, external considering temporarily taking sites offline if updates or temporary protections cannot be applied quickly enough.
The US National Security Agency has also urged “heightened awareness” in the coming weeks, telling people to closely monitor updates from software vendors.
“Vigilance in applying patches related to those systems is paramount,” it said, external.
And while the onus lies mainly on website operators, users should stay alert for any security advice issued by affected services, such as requests to change passwords, Kanhere said.
He warned people to be alert to any phishing messages exploiting the publicity around the incident too.
