PHP security flaws raise hacking concerns: 5 ways to protect your accounts and stay safe online

A software vulnerability can put websites, apps and user data at risk, even when people follow basic online safety practices. The challenge is growing as artificial intelligence (AI) tools make it easier to spot software weaknesses and potentially exploit them.

A recent security scare involving PHP, a programming language used by nearly 70% of websites, has highlighted the risks. The US National Security Agency (NSA) warned that attackers could exploit the flaws to take control of web servers, steal data or disrupt services. The vulnerabilities prompted organisations to review their systems and apply security fixes.

If you are an ordinary user, the incident is a reminder that online safety depends on more than strong passwords. While you cannot repair a website's underlying software yourself, you can strengthen your accounts, keep your devices updated and recognise scams that exploit cybersecurity news to trick people.

MUST READ | Things will 'get a lot worse': Anthropic security chief issues stark warning on digital security

1. Enable multi-factor authentication and use unique passwords

Avoid reusing passwords across email, banking, shopping and social media accounts. If one service is compromised, reused credentials can put other accounts at risk. Enable multi-factor authentication (MFA), which adds a verification step beyond your password. A password manager can help you create and maintain unique passwords for different accounts.

2. Update your devices, apps and router

Turn on automatic updates for your smartphone, computer and apps. Do not overlook your home Wi-Fi router or connected devices, which may also need security patches. Install updates through official settings or trusted vendor websites rather than unfamiliar links. For more guidance, read how to update Android and iPhone apps to improve device security. These updates can fix known vulnerabilities and reduce the window in which attackers may exploit them.

3. Do not trust urgent security messages

Scammers may exploit major cybersecurity incidents to send fake warnings about compromised accounts. Avoid clicking unexpected links or sharing passwords and verification codes in response to unsolicited messages. Instead, open the official app or type the website address yourself to check whether an alert is genuine. Be particularly cautious of messages pressuring you to act immediately.

DON'T MISS | What is PHP, and why did a decades-old programming language take government websites down?

4. Keep a close eye on financial accounts

Enable bank transaction alerts and check your statements regularly for unfamiliar payments. Be cautious when shopping on unfamiliar websites, and avoid reusing passwords for financial services. Consider passkeys where available. These digital credentials can offer stronger protection against phishing by reducing the need to enter a password on a website.

5. Remember that businesses must patch vulnerabilities

Individual precautions cannot eliminate every risk. Companies must identify software flaws, release security updates and check whether their systems have already been compromised. If a service you use announces a security incident, follow its official guidance and change your password if recommended. Users cannot patch a website's underlying code themselves, making timely action by service providers essential.

AI is speeding up cybersecurity tasks for both defenders and attackers, but personal precautions still matter. Start by enabling MFA on important accounts, installing pending updates and monitoring unusual account activity. These steps cannot guarantee complete protection, but they can help reduce your exposure to online threats.