A worldwide security alert for PHP, the programming language used by websites and services including WordPress, led to emergency updates on Oct. 21 to fix two critical vulnerabilities nicknamed “PHP2Shell.” The National Security Agency says the flaws could allow attackers to take control of affected web servers without a password, potentially exposing sensitive information or disrupting services.
The NSA urged immediate patching and recommended taking affected systems offline if updates could not be applied promptly. In Switzerland, ETH Zurich temporarily took some PHP-based services offline as a precaution.
What Fishers businesses should do about PHP
Local businesses are advised to contact their website developer or hosting provider to confirm that updates and security checks are complete. PHP issued an Oct. 23 follow-up advisory addressing an additional risk under an unusual combination of settings; providers should review that latest guidance.
Visiting a website that runs on PHP does not mean a visitor’s computer or phone needs repair, New Zealand’s National Cyber Security Centre advises.
Protecting residents from scams
The website vulnerabilities are separate from consumer fraud concerns raised by Kyle Pierce, vice president of information security at Everwise Credit Union, which has two Fishers branches. In commentary for Cybersecurity Awareness Month, Pierce warns that artificial intelligence makes familiar scam clues less dependable, and that criminals can produce polished messages, impersonate organizations and imitate familiar voices.
“A phone call that appears to come from your financial institution or a desperate plea from a family member might not be what it seems,” Pierce writes. He says one warning sign remains especially useful: pressure to act immediately.
Pierce recommends ending unexpected conversations requesting money or personal information, then contacting the organization through a trusted number or website. Contact details supplied in the suspicious message should not be used for verification. He also urges consumers to review account activity regularly and to promptly report unfamiliar transactions.
Anyone who suspects they have shared sensitive information or sent money to a scammer should contact their financial institution or card issuer immediately; embarrassment should not delay a report. Pierce’s central advice: pause long enough to question the request before acting.
