Urgent PHP Security Fix

October 21st cyberattack affects 70% of websites. Non-profits are at risk.

PHP Remote Code Execution Vulnerabilities:
A set of vulnerabilities, called PHP2Shell, are a pair of critical flaws that let an unauthenticated attacker run code on any PHP installation that serves web requests, which covers WordPress, Drupal, and most other PHP-based sites. This means that an attacker can gain full control over your website without having an account and use it to attack website visitors, replace content, and conduct fraud.
 

What you and your team need to do:

• Please instruct your staff to update every device and app they can: browsers, apps, operating systems, computers, and phones/tablets. If a reboot is required to complete the update, please do it. We recommend that folks do this for personal devices as well.
• For any websites or web applications that use PHP, including common website platforms like WordPress or Drupal, please update the server operating system, and determine if you run PHP applications or not.
• If you run PHP applications, ensure that you are running a supported version of PHP that receives updates (at least 8.2), and install updates for your version of PHP.
• For any web applications that you host at a managed service (e.g. WPEngine), or that a web developer maintains for you, please ask them what they are doing to ensure that the systems that host your site are being updated to remediate these issues.

Here's more info on steps to fix: https://blog.tappnetwork.com/php-security-fix-october-2026-nonprofit-websites