PUBLIC SERVICE ANNOUNCEMENT FROM YOUR LOCAL CYBER SECURITY SPECIALIST For those who don’t know what this recent PHP security vulnerability means: This affects most public facing websites. These vulnerabilities can allow someone to gain access to most websites and their hosting server. That could give them access to sensitive information and/or creds. That is a serious problem. Companies are working on patching this immediately. But if someone already got in, patching the vulnerability isn't enough. Backdoors could still be there and you can't take back already stolen data. The part I am most concerned about. Do these companies have the knowledge, staff, and information needed to properly investigate whether someone got in before they applied the fix? Most don't. You are going to hear things like "your data was encrypted" this does not automatically mean it was safe. If someone controls the service that can decrypt that information, or the attacker has plenty of time and resources on their hands, the information can be decrypted. This can also affect apps and other services that rely on these connections. How far an attacker can get depends on what those servers can access and how well the company has separated its systems. From many years of experience, most companies don't have good security posture. FOR THE REGULAR NONTECHNICAL PERSON: Don’t assume every account you have was hacked. This is a REALLY good time to pay attention and get your account security in order. SO: Keep an eye out for breach notices and unusual login activity. If you get an unexpected message telling you to reset your password, go to the company’s website or app directly. Don’t blindly trust or click links in emails. Fake security warnings will ramp up to take advantage of peoples fear. Stop reusing passwords, ESPECIALLY THE SAME PASSWORD OR A VARIATION OF IT. Use a different password for each account, and turn on multifactor authentication wherever possible. Start with your email. If a company tells you your password was exposed, change it there and anywhere else you used the same or a similar one. Being a regular person does not mean you’ll be ignored. A lot of account attacks are automated. Someone doesn’t need to know who you are to try your and a thousand other peoples stolen login on a hundred other websites simultaneously. If you have ANY questions or need any help what so ever please let me know.