This Just In!
You may never have heard of PHP, but there’s a good chance your small business website relies on it. And right now, that could be a serious security concern.
On October 21, emergency security fixes were released for two critical PHP vulnerabilities that could allow hackers to gain access to affected web servers without a password. For small businesses, the consequences could include stolen customer information, disrupted sales, compromised websites, and costly cleanup.
The good news? You don’t need to understand PHP to protect your business. But you do need to make sure someone is taking care of the problem.
I asked Jordan Brannon, COO, President, and co-founder of Coalition Technologies, a digital marketing agency that builds and maintains business websites, what small business owners should know, whom they should contact, and how to make sure their websites are protected.
Rieva Lesonsky: What is PHP, and how do I know if my website uses it?
Jordan Brannon: PHP is one of the tools that makes websites work behind the scenes. PHP helps websites collect, save, and use information, whether someone is updating the website, submitting a contact form, viewing products, or placing an order.
As a small business, the odds are likely you depend on PHP in some way, even if you’ve never heard of it. The easiest way to check is to ask your hosting company or whoever maintains your website.
Lesonsky: What could these vulnerabilities mean for a small business?
Brannon: These security flaws could let someone break into an affected website without needing a password. Depending on what they gain access to, they could steal information, change your pages, or take your site offline. For a small business, that can mean blown customer trust, lost sales, missed inquiries, and a cleanup bill. Many governments also have extensive (expensive) requirements for businesses that have been hacked.
Lesonsky: Who should be fixing it?
Brannon: Your hosting company will often handle the PHP update, especially if you pay for managed hosting. Your website team should help confirm it’s been done and check that your forms, checkout, and other important features still work afterward. You may also want to contact software vendors that connect to your website to see if they have made their updates.
The concern is when everyone assumes someone else is taking care of it. Ask directly who is handling the update and when it will be complete, because updating your website on its own doesn’t fix the issue.
Lesonsky: How can I check that it’s fixed, and would I know if someone got in?
Brannon: Ask your host or website team, “Have the fixes for both newly announced PHP security flaws been applied to my website?” Get confirmation for your specific site, since a general announcement that updates are underway doesn’t tell you whether yours is finished. Most hosting and website companies are VERY familiar with these concerns and will be able to answer you promptly.
Watch for things like pages you didn’t create, visitors being sent to another website, unfamiliar admin accounts, or security warnings. Those are reasons to get help promptly, but a hacked site can also look perfectly normal. If you’re concerned, ask your team to check for signs of a break-in too, because installing the update won’t undo damage that already happened.
Lesonsky: What should businesses do going forward?
Brannon: You don’t need to become a website security expert, but you do need to know who is playing that role for your site. Lots of small business owners will be in trouble because they thought someone was handling it, or that they were too small to matter in a global hack.
Ask whether your hosting and maintenance plans include security updates, monitoring, backups, and help recovering from an attack. Keep software updated, use unique passwords and two-step verification, and remove accounts people no longer need. Have someone confirm that your backups can actually be restored, so you have a way to get back up and running if something goes wrong.
Rieva Lesonsky is the founder of Small Business Currents, a content company focusing on small businesses and entrepreneurship. You can find her on Twitter @Rieva, Bluesky @Rieva.bsky.social, and LinkedIn. Or email her at Rieva@SmallBusinessCurrents.com.
Photo courtesy Michael Geiger jackson_893
