A reported security vulnerability in PHP, a programming language used by approximately 70% of websites worldwide, has prompted concerns among businesses and government organisations, according to the report.
The flaws affect the underlying code, and the US National Security Agency (NSA) has warned that attackers could potentially exploit them to take control of web servers, steal sensitive information, disrupt online services or move through connected networks.
Although much of the responsibility for addressing the vulnerabilities rests with software providers and organisations operating websites, cybersecurity experts say individuals can take several practical steps to strengthen their online security.
Hideki Matsui Reportedly Set to Become Tokyo Yomiuri Giants Head Coach
1. Enable Multi-Factor Authentication
Multi-factor authentication (MFA) requires users to provide two or more forms of verification when accessing an account, such as a password combined with a verification code or security key.
Emily Austin, principal security researcher at cybersecurity firm Censys, recommends using unique passwords for individual websites and monitoring financial transactions for suspicious activity.
However, Austin cautioned that users have limited control over vulnerabilities affecting the websites and services they rely on.
For PHP-related flaws, she said, users must largely depend on service providers to identify affected systems and install the necessary security patches.
The reported vulnerabilities are part of a broader pattern of serious software security flaws that can become easier to identify and exploit as artificial intelligence tools grow more capable and accessible.
2. Turn On Automatic Updates
Dan Guido, chief executive and co-founder of cybersecurity firm Trail of Bits, recommends enabling automatic updates on smartphones, computers and home routers.
Software developers regularly release security patches to address known vulnerabilities. Installing updates promptly helps reduce the period during which attackers may be able to exploit a flaw.
Guido also stressed that individual precautions cannot eliminate risks arising from vulnerable third-party services.
“Someone visiting a website can do everything right, like use two-factor authentication, and still have their information exposed,” Guido said. “You can’t patch your hospital’s website.”
He said organisations must deploy security fixes more quickly and limit the potential damage caused by compromised systems.
Runa Sandvik, founder of Granitt and a digital security expert, also advises users to update applications and connected devices whenever updates become available.
Internet-connected home equipment deserves particular attention because some devices receive infrequent updates or may no longer be supported by their manufacturers.
Sandvik recommends contacting vendors to check whether security updates are available for such devices.
3. Organisations Must Patch Vulnerabilities Quickly
Dr Daniel Gardham, a lecturer at the Surrey Centre for Cyber Security and the University of Surrey, said organisations need to maintain an accurate inventory of their software, apply security patches promptly and investigate whether their systems have already been compromised.
Gardham warned that artificial intelligence is making vulnerability discovery faster, while securing the many systems that depend on affected software remains a complex task.
“Finding vulnerabilities is becoming faster and easier, but fixing them across the range of systems that rely on this software is much harder,” he said.
He added that how effectively organisations address this gap will help determine whether AI makes the internet safer or more vulnerable.
4. Watch Out for Cybersecurity Scams
Major cybersecurity incidents often create opportunities for scammers to trick users into revealing passwords, financial information or other sensitive data.
Nic Adams, co-founder and chief executive of cyberkinetics company 0rcus, urged people to be cautious about unsolicited links and urgent messages claiming that an account needs immediate protection.
“When these headlines hit, check the affected company’s instructions by opening its app or typing its website address yourself,” Adams said.
Users should avoid clicking unexpected links in emails, text messages or social media posts, particularly those demanding immediate action to secure an account.
Instead, they should access the relevant service through its official app or by manually entering its verified website address.
5. Protect Banking and Shopping Accounts
Paul Benda, executive vice president of risk, fraud and cybersecurity at the American Bankers Association, said banks have invested considerable effort in strengthening their defences against increasingly sophisticated cyber threats.
However, he cautioned that consumers should remain vigilant, particularly when shopping through unfamiliar retailers and websites that may have weaker security protections.
Benda advised consumers against reusing passwords across shopping accounts and recommended considering passkeys wherever available.
Passkeys are digital credentials associated with specific websites or services. They can reduce reliance on traditional passwords and provide stronger resistance to phishing attacks.
Consumers should also monitor their accounts and transactions, report suspicious activity promptly and contact their bank through official channels if they suspect their information has been compromised.
What This Means for Everyday Internet Users
The reported PHP vulnerabilities highlight a central challenge in cybersecurity: even careful users can be exposed when the websites and services they trust contain security flaws.
Individuals can reduce their risk by using unique passwords, enabling multi-factor authentication, keeping devices and applications updated, and avoiding suspicious links.
Ultimately, however, protecting users also depends on website operators and software providers identifying vulnerabilities, applying patches quickly and checking for signs of compromise.
As AI tools make it easier to discover and potentially exploit software weaknesses, timely security updates and responsible system management remain essential to protecting the digital services people use every day.
