On October 21, a widely used website technology, PHP, released emergency fixes for two serious security flaws. Security researchers nicknamed them “PHP2Shell.” PHP is behind-the-scenes software that powers roughly 70% of websites. If a site is built on WordPress, Drupal or Joomla, it runs on PHP. Many online tools and portals use it too.
The two flaws let an attacker take control of the server a website runs on without needing a username or password. In other words, someone could get in through the back door without a key.
A few details make this one more urgent than most:
Bank and credit union websites are attractive targets because of what sits next to them: online banking logins, loan and account applications and personal financial information. If attackers take over a site, they can use it to steal information or quietly send visitors to fake login pages or tethers that look just like the real thing.
For many community banks and credit unions, the biggest exposure isn’t your main website. It’s the third-party vendors you partner with. Online banking, loan portals, account-opening tools and rate feeds are likely run by third-party vendors. Those systems are only as secure as each vendor’s response to this issue.
Your website’s security
Attackers could hijack multiple areas of your website, such as with redirects to fake login pages, malware downloads, hidden tracking codes, or fake pop-up messages, to name a few. If these things aren’t caught and corrected, it could lead to SEO and spam damage.
Your vendors’ systems
If a vendor that handles your online banking, applications or rates uses PHP and hasn’t updated it, attackers could access the personal information of your customers or members. Vendors may also take systems offline briefly to install the fix. That could leave people unable to log in or apply for a while.
Information typed into online forms
When attackers control a server, they can read or copy anything people type into its forms. On a loan or account application, that includes names, Social Security numbers and account numbers. That’s exactly the information criminals use for identity theft and fraud.
Leaked passwords and "digital keys”
One flaw can cause small pieces of a server’s memory to leak. Those pieces can include passwords, active login sessions or the digital keys that connect a website to other systems. If accessed, attackers could get into accounts or move deeper into an institution’s technology.
It depends on how your site is built and hosted.
If your website runs on HubSpot, HubSpot hosts the site and manages security on its own servers. You don’t need to worry.
If your website runs on DNN or Kentico, it’s built on Microsoft technology, not PHP, so it isn’t affected by this issue.
If your website runs on WordPress, Drupal, Joomla or a custom build, check with your web host or IT team right away to confirm PHP has been updated.
You don’t need to be technical to take the right next steps. Here’s a simple checklist:
1. Ask your web host or IT team two questions: “Does our website use PHP?” and “Has it been updated to the latest version?”
2. Contact your key vendors. That includes online banking, loan origination, account opening, rate feeds and any other tool that collects information online. Ask whether they use PHP and whether they’ve installed the fix. Request a written response.
3. Have a message ready in case of downtime. If a vendor takes a system offline for updates, at a minimum, you’ll want a website banner, a social media post and talking points for frontline staff ready to go.
4. Remind customers and members how you’ll contact them. A short reminder that you’ll never ask for passwords or account numbers by email, text or phone helps protect them from fake login pages and scams that often follow news like this.
5. Follow up on anything that’s still open. If a vendor or host can’t confirm they’ve updated, flag it with your leadership and compliance teams.
PHP2Shell is serious, widespread and already being used by attackers. The fix is available, so the most important thing your institution can do is confirm that everyone who touches your website and online tools has applied it. A few emails and phone calls this week can go a long way toward protecting your customers or members and your reputation.
If you have questions about your website or want help preparing communications, we’re here to help.
Sources
Contact us with questions.