If you have received more emails about passwords and security this week than in the whole of the past year, you’re not alone, and you haven’t been singled out. We thought it would help to explain briefly what’s behind them, and to share the handful of things that make a real difference.
What happened?
On 21 October, two serious flaws were found in PHP, a piece of software that runs behind roughly seven in ten websites, from online shops to Wikipedia. They had gone unnoticed for over ten years and were finally uncovered by researchers using AI. Fixes were released straight away, and organisations everywhere – including dozens of UK government services – briefly took their websites offline to apply them. Much of what has landed in your inbox is companies letting you know they have done exactly that. Ours included: all of boosst’s systems were updated straight away.
The flaw sits on websites’ servers, not on your phone or computer, so there is nothing for you to install. In fact, any message asking you to download a “PHP update” is a scam.
Why we’re writing about it
We spend a lot of our time helping clients tune out noise – the headline about markets falling, the forecast that never comes true. This week’s emails are a little like that. Most of them need nothing from you, and reading every one just leaves you feeling uneasy.
There is one difference, though. Your plan is built to ride out falling markets, but it can’t ride out someone else getting into your accounts. You can’t fix the internet, but you can make sure that if one of your passwords does leak, it doesn’t open anything that matters. So rather than add another worrying email to the pile, here is the short list we would give our own families…
Five things worth twenty minutes this weekend
- Give your email its own password, and a second lock. Your email is the master key, because it can be used to reset almost every other account. Make sure its password isn’t used anywhere else, and turn on two-step verification – a second check, usually on your phone, after you type your password.
- Say yes to passkeys. When a website or app offers you a “passkey”, accept it. It lets you log in with your fingerprint, face or phone PIN instead of a password, and the National Cyber Security Centre now recommends passkeys over every other option, because there is nothing for a fraudster to steal.
- Let a password manager do the remembering. If you use an iPhone or Mac, Apple Passwords is already built in and will create and remember a different password for every site. Google Password Manager does the same on Android. Both will also tell you if a saved password has turned up in a breach.
- Don’t click the link – go the long way round. If an email asks you to change a password, close it and go to the company’s app or website yourself. A real company will never mind.
- Pause before moving money. Any urgent request to move money, or to pay new bank details, deserves a phone call to a number you already know, even if it seems to come from someone you trust. Your bank will never ask you to move money to keep it safe.
If you look after a website
If you run a business, or help out with a charity or sports club, and it has a website – especially one built on WordPress – it’s worth a quick check that it has been updated. If someone manages it for you, a one-line email asking “have the October PHP security updates been applied?” is all it takes. If you look after the hosting yourself, the PHP version can usually be updated from your hosting control panel in a few clicks, and your host’s support team will help if you’re unsure.
If something doesn’t look right
Call your bank on the number on the back of your card, or dial 159 to reach the fraud team at most UK banks. Suspicious emails can be forwarded to report@phishing.gov.uk.
If you help a parent or one of your children with this sort of thing, feel free to pass this on. And if you would like to talk any of it through, we are always here.