You may have seen social media posts or the FBI, NSA, and CISA warnings this week about two serious security flaws in PHP.
Here's what that means and whether it affects you.
PHP is the code running underneath WordPress and millions of other websites. Think of it as the decking under a flat roof. You never see it, but the whole roof sits on it.
On October 21, the team that maintains PHP announced two critical flaws that could allow hackers to take control of a vulnerable website's server without ever logging in.
The good news? There's already a fix.
The server needs to run an updated, secure version of PHP. Some hosting companies handle that automatically. Others leave it up to the website owner.
If Max Potential Media hosts your website, it’s already taken care of. The security update was applied, and no action is needed on your part.
One word of caution: If someone contacts you out of the blue offering to fix this problem for a fee, check with me first. Unfortunately, situations like this tend to attract scammers.
Respectfully,
Owen Shrock
P.S. If Max Potential Media isn't hosting your website and you're not sure whether it's protected, just hit reply with your website address. I'll take a quick look and let you know what I can verify.
Prefer to check it yourself? Log into WordPress and go to Tools > Site Health > Info > Server. Look for PHP version 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or a newer version within the same series). These versions include the security fix. If you see an older version, contact your hosting provider immediately to confirm whether a security patch has been applied.
If you're not an Insider yet and you run a commercial roofing business, hit the subscribe link to get timely updates like this one.
To learn more about websites for commercial roofers, visit commercialroofingwebsites.com.
