Attackers may have used the PHP security flaws made public on 21 October before anyone else knew about them, says Tomas Stamulis, chief security officer at cybersecurity specialists Surfshark.
Also, on sites that haven’t installed the PHP fix yet, attackers could take over the server or read passwords and other private data from its memory. Stamulis recommends changing weak and reused passwords on your most important accounts and checking where your payment cards are saved.
“When you leave home, you check that the doors, windows, and gates are locked,” he says. “Most people don’t check the chimney or the air vents as a precaution. The PHP2Shell vulnerability represents exactly that kind of overlooked entry point – a ‘vent’ that remained unnoticed for over a decade until AI identified it as a way in.”
Did hackers get there first?
Stamulis says it’s a real possibility they did, especially for organisations that don’t keep logs or watch their IT systems for attacks.
“We can’t rule out that attackers found these holes before they were even made public,” he says. “Companies without logs or monitoring might never know someone got in.”
Speaking of the current situation, many public and private organisations don’t have their own IT teams. They rely on external providers to install fixes, and then processes are often slower. Until a site is updated with the latest PHP fix, the passwords and card details customers saved there could be at risk.
“As a user, you can’t see what’s happening on a website’s server, so the safest thing is to act now,” says Stamulis.
What to do?
Stamulis recommends:
- Use a data leak monitoring tool to be automatically notified of your data leaks.
- Change weak and reused passwords. Start with your email, bank, and the other accounts that matter most to you. Give each account its own password and use a password manager to keep track of them.
- Check where your main card is saved. Delete your card details from sites you rarely use.
- Pay online with a virtual card. If the number leaks, you can block it without replacing your main card.
- Turn on two-factor authentication. This adds a second step when you log in, like a code sent to your phone. If a password leaks, it’s much harder for anyone else to get into your account.