[{"data":1,"prerenderedAt":45},["ShallowReactive",2],{"story-214277-en":3},{"id":4,"slug":5,"slugs":5,"currentSlug":5,"title":6,"subtitle":7,"coverImagesSmall":8,"coverImages":9,"content":12,"questions":13,"relatedArticles":32,"body_color":43,"card_color":44},"214277",null,"PHP Zero-Day Alert | Seller Server Security Actions","- Millions of exploit attempts hit PHP-based storefronts, WordPress and WooCommerce sellers face data theft and downtime risk",[],[10,11],"https://i.guim.co.uk/img/media/e240560dbdb0dfbd8f0e19f35e6bf6650b057f87/0_0_3000_2400/master/3000.jpg?width=465&dpr=1&s=none&crop=none","https://ichef.bbci.co.uk/ace/standard/1024/cpsprodpb/8989/live/fc0a0a30-cde4-11f1-a64c-550be9e3c66b.jpg","Two critical **PHP** vulnerabilities (dubbed PHP2Shell) triggered millions of exploit attempts within days of disclosure, putting **WordPress**, **WooCommerce**, Magento-style and custom PHP storefronts at immediate risk of data theft and takeover. The news reports that Cloudflare CEO Matthew Prince logged tens of thousands of attempts within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by Thursday 22 October 2026. The flaws were found by Calif, Wiz and OpenAI under the Patch the Planet initiative, and the NSA urged immediate patching or taking affected systems offline. For compliance purposes, this is a security incident with potential personal-data exposure, so it should be treated as a priority.\n\n**Server-side exposure is the core seller risk, and it is not limited to downtime.** The news reports that an attacker who gains a shell on a web server can steal customer records and payment-related data, plant backdoors and move laterally. Under GDPR Article 33, a breach of personal data generally must be reported to the supervisory authority within 72 hours of awareness, so EU-facing sellers should document their patch timeline now. Hosting-managed sellers on shared plans depend on their provider; the news notes Amazon kept sites running after detecting attempts, showing that large operators had monitoring in place that small shops may lack.\n\n**Small and mid-sized storefronts are the most exposed segment.** Industry data shows that a large share of PHP storefronts run on shared hosting with unpatched WordPress plugins, and the news notes that schools, local governments and charities often lack dedicated security staff. Similar events historically drive a second wave of attacks on the same plugin ecosystems, so sellers should expect follow-on campaigns for weeks. Sellers in apparel, beauty and home goods that store card tokens or customer profiles should prioritise audits because breach notification costs and chargeback exposure can run into thousands of dollars, depending on record volume.\n\n**Cross-referencing the two reports, the pattern is a compressed disclosure window.** The original patch date was late October, but a social-media leak and a mistakenly published exploit video forced earlier disclosure, which means the patch-to-exploit gap has collapsed. Woodward criticised this timing, and the reporting indicates that patch adoption rates remain uncertain. Expect continued pressure on the AI-assisted vulnerability discovery model across the industry. Sellers should expect the impact to be concentrated in the first 30 days, with rising compliance expectations from PCI DSS-bound payment processors thereafter. Officials have not confirmed the number of successful attacks, so treat any unexplained login, file change or traffic spike as a potential compromise until proven otherwise.",[14,17,20,23,26,29],{"title":15,"answer":16,"author":5,"avatar":5,"time":5},"How do I check if my PHP storefront is affected by the PHP2Shell vulnerability?","The news reports that the flaws affect PHP broadly, and Wiz estimates roughly 70% of the internet is exposed, a figure not independently verified. Check your PHP version with phpinfo() or ask your hosting provider, then confirm the patched release once the PHP Foundation publishes it. Review web server access logs for unusual requests targeting PHP endpoints, and treat any unexplained activity as a possible compromise.",{"title":18,"answer":19,"author":5,"avatar":5,"time":5},"What is the difference between patching and taking a site offline during this incident?","Patching fixes the flaw at source, while taking a site offline stops exposure but causes lost sales. Industry practice is to take the site offline only if the patch cannot be applied quickly, because the NSA guidance treats offline as the fallback. Shared-hosting sellers should ask their provider whether the fix is already live before deciding.",{"title":21,"answer":22,"author":5,"avatar":5,"time":5},"How quickly do sellers need to patch, and what does it cost?","The news reports that exploit attempts reached millions within days, so sellers should patch within 24 to 48 hours of the official release. Managed hosting patches are often free, while a freelance security audit of a small store typically runs in the low hundreds to low thousands of dollars. Compare that with breach costs, which can exceed the audit cost many times over.",{"title":24,"answer":25,"author":5,"avatar":5,"time":5},"Should I rotate passwords and API keys after this PHP vulnerability?","Yes. Because attackers who gain server access can read configuration files, rotate database passwords, payment gateway API keys, SMTP credentials and admin logins after patching. Prioritise keys for Stripe, PayPal or other payment processors, and enable two-factor authentication on all admin accounts.",{"title":27,"answer":28,"author":5,"avatar":5,"time":5},"Should WooCommerce sellers take their stores offline until the patch is applied?","The NSA advised organisations to apply the update immediately and, if that is not feasible, to take affected systems offline. Amazon detected exploitation attempts but kept its sites running, while Wikipedia took down parts of its site and several Dutch, Danish and Finnish government services went offline as a precaution. For a small WooCommerce store, a short maintenance page while patching is usually lower risk than running an unpatched server with payment data.",{"title":30,"answer":31,"author":5,"avatar":5,"time":5},"What compliance obligations arise if customer data was exposed in this PHP attack?","If personal data of EU customers was accessed, GDPR Article 33 generally requires notification to the supervisory authority within 72 hours of becoming aware of the breach. Sellers handling card data should also notify their acquiring bank and follow PCI DSS incident procedures. Keep a dated log of detection, patching and containment steps, since regulators will ask for it.",[33,38],{"id":34,"title":35,"source":36,"logo":10,"time":37},1658837,"Websites across world hit by millions of attempts to exploit PHP code flaw","https://www.theguardian.com/technology/2026/oct/22/websites-across-world-hit-by-millions-of-attempts-to-exploit-php-code-flaw","12H AGO",{"id":39,"title":40,"source":41,"logo":11,"time":42},1658802,"PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live","https://www.bbc.com/news/live/ckgel5xp2xv9t","18H AGO","#7bdcc2ff","#7bdcc24d",1792729854369]