Yesterday, the U.S. NSA, CISA and the EU’s cybersecurity agency all warned about two critical flaws in PHP, the software that runs most business websites, including WordPress sites. Patches are out, but attacks have already been reported, and some organizations in Europe have taken their sites offline as a precaution.

The one action for members: contact your web host or developer today and confirm the October PHP security update has been applied. If they can’t confirm it, consider taking the site offline until it is.