Two critical PHP bugs went public yesterday (PHP2Shell). Attackers can take over a WordPress site without logging in, and attacks were seen before the patch came out.
Do this now:
→ Check your PHP version: WordPress → Tools → Site Health → Info → Server
→ Safe versions are 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer
→ On shared or managed hosting, ask support to confirm the patch is in
→ On PHP 8.1 or older there’s no official fix, so upgrade
→ If you use Cloudflare, its free WAF already blocks the known attacks (the proxy must be on)
Also on Railway? They had a breach the same day. Rotate every API key and password you stored there, AI keys first.
Questions? Ask below.
Comments (0)
Log in to join the conversation