PHP bug
Hey so just a heads up, and you are all probably aware but thought I’d share for those of you who use php on your websites
is PHP2Shell, a pair of critical flaws disclosed yesterday in PHP, the programming language that runs a large share of websites. The bugs are in PHP itself, not in any particular app, so every affected website is at immediate risk. Attackers can pull memory from the server, and that memory can include passwords, session tokens, API keys and private keys used by other visitors. Wiz showed working attacks against WordPress, Drupal and Joomla.
For you: if your shops run only on Shopify, Etsy and Gelato, you don't need to do anything. Those are hosted platforms, and patching their servers is their job. You only need to act if you have your own website on WordPress or another PHP site through a web host such as Bluehost, GoDaddy or SiteGround.
If you do have a WordPress or PHP site:
Confirm with your host that PHP has been updated. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Managed hosts usually update PHP automatically, but check.
After the patch, change your site's admin password and any API keys it uses, like payment or email plugins. Security firms advise doing this now instead of waiting for proof of a break-in, because this kind of memory leak leaves little trace.
Don't rely on workaround settings. The PHP team says no workaround is complete and updating is the only safe choice.
Line for your manual:
Security updates (hosted platforms): Shopify, Etsy and Gelato patch their own servers. For any self-hosted site (WordPress/PHP), when a critical PHP or WordPress vulnerability is announced: (1) confirm with the host that PHP is updated, (2) then change admin passwords and API keys, (3) update WordPress, themes and plugins.
Do you have a WordPress site, or is everything on Shopify and Etsy?
Sources:
Thanks Larissa! One more reason not to use WordPress ;)