Three security disclosures in one week: what to check.

Between October 20 and 21, three serious security issues went public at once. Most of the business owners we spoke to hadn’t heard about any of them. If you have a website or an app, here is the short version.

What happened

• PHP: two critical bugs let attackers run their own code on a server without logging in. PHP runs WordPress and much of the web. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Versions 8.1 and older get no fix.
• Node.js: ten security fixes, four of them high severity, in the runtime behind most modern web apps and APIs. Fixed in Node 22.23.4, 24.22.1 and 26.12.1.
• eMudhra: a certificate authority generated keys so weak that anyone can recover them and fake a “secure” connection. Browsers already block them. Servers, apps and devices with old certificate lists don’t.

What it means for your business

Being small doesn’t make you safe. Attackers scan the whole internet automatically, and they start within hours of a disclosure. “Managed” hosting doesn’t always mean patched either: some hosts update for you, others expect you to rebuild the server yourself.

The real risk is old software. Anything on a version that no longer gets updates stays vulnerable, however many patches come out.

Three questions to ask whoever runs your product

• Who hosts it, and do they apply security updates for us?
• What does it run on (PHP, Node.js, WordPress, which framework), and which version?
• When was it last updated? If the answer is “a year ago” or “I’m not sure”, that is your answer.

What we did this week

We checked every server we look after within a day of the fixes. Most apps only needed a rebuild on the patched version. The older ones took real work: their frameworks didn’t support a current Node.js, so they needed code changes and testing first. One dormant WordPress site became a static HTML site instead. No PHP left, so nothing to patch next time.