I have just moved another thread on this into "News and Assistance" and merged them.  So now answers for you "upthread' - thanks for asking / bringing it to attention - best twice than not at all.    I am taking a look at other sites on both servers too.

 
Not sure if it's wise to muck about while this security thread/threat develops, but I have grabbed an extra copy of the Coffee Shop databases to my laptop in - oops giving the game away - Pravia.  And I have told the worker server that if it gets any requests from other that the receptionist, it's to turn them away - so the receptionist is to act far more as a firewall than [he/she] has done until now.   This may break a few older pages, but now makes sense.

The taking up of the backups does NOT  make us immune in itself to anything, but it does mean that as and when I have a decently fast Internet connection, I could restore things.   As we don't collect personal data, payments, etc, there is very little to be leaked or stolen anywhere on our servers - the risk of a problem on the worker is low, and the effect would be low - an outage until I could rebuild which while away might be a few days, and a risk that data in places like "frequent posters" and potentially registered email addresses could be leaked, but none of it would leak in an easy-to-use form.

 
Severe PHP vulnerabilities reported today times 2 - such that patches need immediate implementation with sites taken down until repaired.

I note that this site has a PHP logo - does it need the patches?

 

At this moment of writing, I am not panicked, but our web space provider for the worker machine reports ...


... and I am watching

 
Just wondered whether this affects the forum?
https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o
The Finnish government, Edinburgh council and the BBC are among those to have taken down sites and pages ahead of a software update to a programming language which underpins many online services.

Two critical vulnerabilities have been found with the PHP programming language, which is widely used across the internet. A fix was issued on Wednesday afternoon.

The flaws were discovered by AI, with cyber-security firm Wiz saying they were the "most severe vulnerabilities ever discovered" by the tech, which is reshaping the cyber landscape.

Multiple national cyber-security agencies have urged organisations to rapidly adopt the updates, or consider taking their websites offline.

Finland has temporarily shut down the government's public web services, while the Netherlands' cyber-security agency said it was taking its own website offline due to the vulnerabilities.

Meanwhile, Edinburgh council's website has become inaccessible, as well as the online homes for several BBC programmes including Doctor Who and The Traitors.

.........continues.............