The Headlines Say the Internet Is Broken. Here Is What You Actually Need to Do.

If you saw the headlines this week, you could be forgiven for thinking the internet itself broke. It did not. A serious flaw was found in the software that runs a huge share of websites, about 7 in 10 websites whose underlying software can be identified. That is a big deal for the people who run those websites. For everyone else, the honest answer is much calmer: there is almost nothing you need to do about this one, and the few things worth doing are things worth doing anyway.

What actually happened

Almost every website you visit is built on layers of software. One of those layers, called PHP, runs behind the scenes on a huge number of sites. Researchers found two flaws in it that let an attacker run their own commands on a website's server without logging in. Researchers nicknamed the flaws PHP2Shell. The flaws were rated severe, and fixes were released on October 21.

Here is the part that matters most for a regular person: the flaw lives on the website's side, not on yours. Your phone, your laptop, and your browser do not run this software, so there is no patch you need to install on your own devices for this. The job belongs to the people who run websites and the companies that host them.

There is one more fact worth knowing, because it keeps the headlines in proportion. Attackers were seen trying to use the flaws before the fixes came out, but when the US government's cybersecurity agency published its warning, it said it had not seen a confirmed case of anyone actually breaking in this way. Attempts are real. A confirmed break-in through these flaws has not been publicly established. That does not mean website owners can relax. It means you, as a visitor, do not need to panic.

Who needs to act

Website owners and hosting companies. If that is not you, skip to the next section. Your part is already done.

If you do run a small site, here is the one thing to get right. Updating your website's content tool, such as WordPress, does not update the layer underneath it. Those are separate updates, and the flaw is in the underneath layer. So do not assume a WordPress update covered it. Ask your hosting company, in writing, one question: has the PHP on my site been updated to a fixed version? The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your host cannot confirm that, or if your site runs an older version that no longer gets official fixes, restrict who can reach the site or take it offline until it can be updated. That is also the advice from the National Security Agency: update, or take the site offline until you can.

What regular people should do

None of this is specific to this week's news. All of it is everyday protection, and this week is a good reminder to get it done.

• Use a different password for every account, and let a password manager remember them. Reused passwords are how one stolen login turns into many. A password manager creates and stores a unique one for each site, so you only have to remember one strong master password.
• Turn on two-step verification everywhere it is offered. That is the second check after your password, usually a code from your phone. Even if someone steals your password, they still cannot get in without that second step.
• Keep your phone, computer, and apps updated. Those updates are how security fixes reach you. Turning on automatic updates is the easiest version of this habit.
• Watch your accounts for anything unusual. A login you do not recognize, a password reset you did not ask for, or a charge you do not know. If you see one, change that password right away and turn on two-step verification if it was not already on.

The panic itself is a trap

Every time a scary security story leads the news, scammers ride it. Expect messages that sound urgent and mention this crisis by name: texts and emails warning that your account is at risk, or offering a security update or a fix tool to download. Those messages are the attack. Their goal is your password.

So do not click urgent security links in a message, even if the message sounds like it comes from a company you use. Do not download a random fix tool, and do not trust a message just because it mentions this crisis. If you are worried about an account, go to that service directly, by typing its address yourself or opening its app, and check there. Never through a link someone sent you.

What not to do

• Do not panic. This flaw is a problem for website owners to fix, not a reason to change your whole digital life today.
• Do not panic-buy or change everything at once. Rushed changes lead to mistakes, like locking yourself out of accounts or turning off protections you actually need.
• Do not install anything claiming to fix this on your personal devices. There is no fix for you to install. A tool that claims otherwise is almost certainly a scam.

The bottom line is simple. The people who run websites have real work to do this week. For the rest of us, the right response is the boring one: unique passwords, two-step verification on, devices updated, and a skeptical eye toward any urgent message that shows up right on cue. That is what actually keeps you safe, this week and every week.

For the full technical story, including the timeline, the other flaws found in the same week, and exactly what website owners need to patch, read the Black October briefing: Black October: A Disclosure Wave, Not a Single Attack.

← kevintswaney.com