Online shops and the PHP flaw: protect customers and payments

The flaw permits password-free server code execution, with a CVSS score of 9,2 out of 10 according to Tenable. Ordinary websites can be altered; shops also expose customer records and orders, while manipulated checkout can send customers to fake payment pages.

Some rules of thumb:

• WooCommerce, PrestaShop, Magento: always PHP. All versions from PHP 5 are affected, reports Help Net Security.
• Shopify and fully hosted platforms: the platform manages servers. You need not update PHP.
• A hosted shop with a separate WordPress site or blog: that part uses PHP and needs updating.

If unsure, the free Marketing Scan PHP check gives an indication in ten seconds.

Ask your host or developer for the exact version and an update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP 8.1 and earlier receive no fix and require at least 8.2.

Upgrading can break old modules or plugins. Arrange:

1. a complete file and database backup;
2. a test on a shop copy where possible;
3. a quiet time such as evening with few concurrent orders.

Work through this list yourself or ask your developer:

• Place and pay for a small test order. Does confirmation email arrive?
• Check administrators. Are any accounts unrecognised?
• Inspect the payment button's destination. Does it lead to your actual provider?
• Compare orders and provider payments. Differences are warning signs.
• Ask about unexpected new or changed server files.

It depends on processing. Most small shops redirect to external payment providers, keeping card data off their server. The main risk is an attacker replacing that link with a fake destination.

Processing payments directly on your own site increases risk. Discuss this with your developer and payment provider, and consider temporary closure if updating cannot happen promptly. Firewalls slow attacks temporarily, but Patchstack identifies updating as the only complete solution.

A vulnerability alone is not a breach. Report when customer personal data may actually have reached the wrong hands, for example when intrusion traces are found.

Under GDPR, report such a breach to Belgium's Data Protection Authority within 72 hours of discovery. Immediately record what you found, when and which data may be affected.

• Change passwords for administrators, hosting, database and payment provider.
• Request new API keys from your provider and other connected services.
• Have your developer find leftover files. Updating closes the door without removing an intruder already inside.
• Restore a pre-intrusion backup if changes are unclear.

On 21 October, the CCB reported no successful Belgian attacks, according to VRT NWS.