Update now, not later: what October's WordPress and PHP attacks mean for your online store

If your online store runs on WordPress or your website runs on PHP, October was a wake-up call. In the second half of last month, three separate security incidents hit the software behind many of the world's websites. Serious security flaws were uncovered, and attackers started exploiting them within hours.

The biggest threat for online businesses in South Africa: If an attacker took over your site, they could use that connection to send funds to themselves, and that money would come out of your account. Similarly, they would have been able to gain access to your customers’ card details, putting them at risk as well.

Stitch takes payments and data security extremely seriously, and we took action swiftly the moment this threat arose, to protect our clients’ businesses and their customers’ data.

Here's what happened, why it matters for your business and what you can do to keep your store safe.

What happened

On 28 October, WordPress fixed a serious security flaw that affects almost every WordPress site running versions 4.7 to 7.1.3 of the WordPress software. The flaw could let an attacker take control of a website without needing a password. WordPress released a fix in version 7.1.4, but everyone running on a previous version had to install the update for it to take effect.

Attackers moved fast. Within hours of the fix coming out, they started using the flaw at scale. One security firm, Wordfence, blocked nearly 63,000 attacks in a single day.

At the same time, a separate wave of attacks, known as PHP2Shell, hit websites built on PHP, the language WordPress runs on. Researchers counted about 5.1 million servers running PHP, including more than half a million WordPress sites. Businesses were told to update their servers immediately, or take their sites offline until they could. A similar flaw also hit Node.js, another common type of website software, in the same week.

Why this matters for your store

Your online store isn't just a website. It's connected to your payment provider, your bank account and your customers' details.

If an attacker takes over your site, they can use those connections to try to move money out of your account. They could also get hold of your customers' personal or card details. That puts your money, your customers’ data and your reputation at risk. In South Africa, customer data is also protected by law (POPIA), so a hacked site can quickly become a legal problem too.

You don't need to be a big business to be a target. Attackers use automated tools to scan the internet for any site running old software. If your site is out of date, it can be found.

Attacks are getting faster

Attackers used to need days or weeks to take advantage of a new security flaw. Now it can take hours. In October, some attacks started before a fix was even available.

Part of the reason is AI. AI tools help security experts find flaws faster. But attackers can use the same tools to find and attack vulnerable websites more quickly. We expect attacks like these to happen more often and to move faster.

For any businesses selling online, waiting for a convenient time to update your site is no longer safe.

6 simple ways to protect your store

1. Update WordPress as soon as a new version comes out. In your WordPress dashboard, go to Dashboard → Updates and click Update. Update your plugins and themes too, and turn on automatic updates if you can.

2. Back up your site. Most hosting providers let you do this in one click. If something goes wrong, you can get your site back quickly.

3. Delete what you don't use. Old plugins, themes and admin accounts are easy ways in for attackers. If you don't need it, remove it.

4. Check for anything unfamiliar. Look out for admin users you don't recognise, plugins you didn't install or new files you didn't add. Your developer or hosting provider can help with this.

5. Use strong passwords and two-step login. Give every admin account its own strong password, and turn on two-factor authentication, so logging in needs a code from your phone as well.

6. Act on security messages straight away. If your payment provider, hosting provider or WordPress warns you about a security issue, treat it as urgent. The businesses that act on the first message come through best.

Not very technical? That's ok. Ask your hosting provider or web developer to keep WordPress, your plugins and your server software up to date for you. You can also find developers or agencies that can help in our vetted Partners Database.

How Stitch helps keep you safe

At Stitch, protecting your money and your customers' data is a big part of our job. We keep a close eye on new security threats, and when something serious happens, like it did in October, we take the precautions needed to protect our merchants and their customers. If a threat could affect your store, we'll tell you what's happening and exactly what to do.

That’s exactly what we did last week. The moment we recognised some of our clients’ sites were vulnerable, we prevented attackers from accessing their payments until they confirmed that their software had been updated. Those that confirmed the update were immediately restored.

Not sure if your site is at risk? Use our free PHP security check tool.

Questions, or need a hand? Email us at express-support@stitch.money and we'll help you get your store secure.