Tips Tuesday – PHP and Updraft Attacks, Cookie Tracking Workshop, AI Search Changes

Tips this week include:

• UpdraftCentral hacked
• PHP Zero-Day vulnerabilities
• Sites running old PHP didn’t get updated directly
• .php files hit directly
• Where you host matters more than ever now
• 19 attacks and counting
• Why Open-Source must be funded
• Banks denying access to AI Agents
• How to protect yourself from all these attacks
• Cookie Tracking Workshop this week
• Meta AI scraping workshop in November
• Ranking in AI Searches
• Google poisoning SERPS for AI bots
• How this poisoning affects us
• More links in Google AI Summary and Overviews

This post contains an affiliate link. Thank you for using it to support the free and helpful info you get from BlogAid.

Security Tips

I told y’all this was going to happen, and here we are.

While I don’t think AI can kill us, it sure can wreak a lot of havoc on our digital lives.

UpdraftCentral Hacked

A few years ago, Updraft decided to offer a service called UpdraftCentral which lets you manage multiple websites from a central dashboard. The problem is, they turned it on by default. Beyond that, they auto issued a key for it in another settings location and didn’t tell anybody.

Well, those keys got hacked on their end and bad actors used them to gain access to lots of sites.

It was 11 hours before they told anyone.

I alerted Dustin at Iridium Hosting and requested a scanner for sites to ensure they were not hit. He was already on it. And, he already had the fix ready for anyone who did get hit before they could make the changes needed.

I made tutorials for my clients and webmasters on the immediate action they needed to take, like deleting that key.

So far that has held, but the damn auto opt-in setting still can’t be cleared. Even if you turn it off, it comes back.

I’ve been jumping up and down with Updraft Support over the foolishness of the auto optin to a 3rd-party service that most site owners don’t even need, plus their lack of transparency about creating that key that was stored on their servers.

They are most definitely taking that complaint seriously.

We’re still awaiting another plugin update to turn off that auto optin.

PHP Zero Day Vulnerabilities

PHP is the coding language that runs 70% of the entire internet. It’s the core language of CMSs (Content Management Systems) like WordPress, Drupal, and Joomla. It is also a core language on hosting servers.

When news of the 2 Zero-Day vulnerabilities and patches was released, the hack attacks started immediately. They wanted to try to exploit any servers that had not been patched yet.

Some sites, particularly government sites and some banking sites in Asia, simply shut down in an abundance of caution until the patches could be applied. 

Sites Running Old PHP Didn’t Get Patched Directly

Because all coding languages change over time, they publicly display dates of when versions are released and when they will reach End of Life, meaning they will no longer be supported.

The PHP versions that were recently patched from PHP directly are 8.1 and above. (Me and my peeps are currently using 8.3 and 8.4.)

Our favored host won’t even allow versions that are end of life to be on the hosting due to the security risk.

The real issue here is that WordPress states the minimum version required as 7.4 – and that version did not get patched directly by PHP. However, older versions did get patched later from those running CloudLinux servers.

To make sense of this, you have to think globally. Hosts and sites in lower-income countries can’t afford to rebuild their servers and sites to meet the PHP 8.x requirements.

When we made the jump from 7.x to 8.x several years ago, some of my clients had to either rebuild or switch themes, and several had to find alternatives to some of their plugins.

So, there definitely is a cost involved to stay current.

For those who can’t, if their sites or servers are hacked, those resources can be used in DDoS attacks on everybody else. So, this lack of update issue puts us all at risk.

.php Files Hit Directly

During audits the day of and the day after the PHP patches I noticed tons of bot hits directly on .php files. Those files only come into play once an instance of WordPress has fired when someone is visiting the site. Those files are not meant to open independently. And when something tries to open them that way, they throw a PHP error.

The PHP error log is something I check during audits, mainly for issues with plugins and themes.

I alerted Dustin at Iridium Hosting and he created new security measures to stop those bots from being able to access those files directly. Any custom coding that might be affected will be handled on a case-by-case basis. But to my knowledge, the only thing that would likely be affected by this is WP Multisite, which the host doesn’t support running anyway.

Where You Host Matters More Than Ever Now

I did an audit on a client who hosts somewhere other than Iridium. To protect folks against the Updraft hack, they simply removed UpdraftPlus from everyone’s site – and didn’t tell them. Now those folks are missing their backups, which is their biggest security net.

Plus, that host has not kept up with the cPanel updates and the new configurations. I can’t even see the PHP errors anymore there.

On top of that, I had to school them on proper PHP configuration, and I’m still not sure all of it has been done correctly. Plus, there is no extra security for the extreme AI bot hits.

The security at Iridium Hosting has been continually beefed up to combat AI bad actors. That not only protects our sites from resource overages, but it also protects the servers from getting hacked.

I frequently report my audit findings to Dustin at Iridium Hosting and he reports new security hits on the server to me. And we also share the Cloudflare setting changes too.

The point is, we stay in lock step with each other to help protect our clients.

You are not going to get that at any other host.

That’s why my webmasters moved their clients to Iridium too. And they count on me and Dustin to keep them informed and safe.

Make the move to Iridium Hosting today and get the kind of speed, security, and support you need now.

19 Attacks and Counting

Over the past week there have been 19 attacks that were level 9 out of 10 on popular coding languages and servers that host coding scripts. Some of those include Node.js, Linux, and GitLab.

There will be more.

Open-Source Must Be Funded

The most popular free softwares like PHP, Linux, LibreOffice, Audacity, OBS, WordPress, Joomla, and Drupal are all Open Source. That means that unpaid volunteers are the main contributors to improve and maintain the software.

Automattic, which is the parent company of WordPress, does have paid staff. And several companies pay at least 1-2 of their employees to be dedicated volunteers to help improve and secure WordPress. In fact, that is what the whole WP vs WPEngine lawsuit is about. Matt accused WPEngine of not paying their fair share to support WP development while making ALL of their profits off its users.

The problem is, we now have AI vs AI. It takes a LOT of tokens and/or compute power for hackers to run an AI to find exploits. Open Source volunteers don’t have those resources to run AI to help find or fix vulnerabilities. And that’s required now because humans going through the code is SO slow.

Plus, AI can probe in ways that humans would never think to do. This is SUPER important!! The flaws recently found in PHP have been there for 22 years. They were thought to be impossible to exploit – maybe for a human, but not for AI.

So, we desperately need more companies that profit from the use of these free softwares to step up and fund dedicated resources, both AI and human, if we hope to curb the onslaught of attacks that will just keep coming.

Banks Denying Access to AI Agents

Some folks have created AI Agents to run their lives, including having access to all of their finances.

A few banks noticed AI Agents trying to take unauthorized actions on behalf of their owners.

Most of those banks have slammed the door on using AI Agents. I hope all banks and financial institutions do the same.

We’ve already seen too many Agents go rogue and do things they shouldn’t, including covering their tracks and literally lying to their owners about it.

AI legislation needs to be enacted globally to fend off a global financial disaster.

Protect Yourself

I’ve been preaching this for years – you MUST be more vigilant and responsible with your online connections.

Do this:

• Rotate ALL passwords regularly – I have a list of all of my online accounts and I rotate every one of those passwords annually. And I request closure and erasure of any accounts that I’m not using anymore.
• Update devices – this includes computer, phones, tablets, your router and anything connected to it like TV, thermostat, appliances, security system.
• Get rid of unused apps on your computer, devices, and TV.
• Put a lock on your phone number to block SIM swaps.

Live Workshops

Cookie Tracking

You may recall the new cookie tracking lawsuits that I mentioned a couple of weeks ago.

I’ve been doing all kinds of testing.

And I’ll be meeting live with my clients and webmasters on Thursday to go over my findings and give them my recommendations.

Meta AI Scraping Workshop In November

I had also planned to meet live with my peeps this week to discuss Meta’s new TOS for scraping our posts on Meta properties as well as our sites to train their AI.

It was supposed to roll out on Oct 30, but due to all of the pushback they’ve received, they have already changed some of that new wording and have delayed the rollout until Nov 20th.

So, we will meet, but not yet, as I predict they will continue to tweak the TOS language.

SEO Tips

Ranking In AI Searches

McDonalds spent years and a lot of money figuring out where to place their restaurants. When Wendy’s came along, they just looked at the map to find where every McDonalds was and put their restaurant nearby.

Think of Google as McDonalds and all of the big AI platforms as Wendys.

Google has spent decades perfected their crawl and ranking methods and how to slam the door on those who are trying to game the system.

The big AI platforms haven’t figured any of that out yet. 

And they have decided to take a shortcut and just scrape results from Google.

But that’s going to backfire – big.

Google Poisoning SERPs for AI Bots

You may recall that I recently reported that Google is trying to block AI scraper bots.

They still are, but what they found in doing it is that many of the bots just keep at it.

In other words, saying no to a bot means it tries harder.

So, Google has started letting them through, but Google is flipping the SERPs on them.

Instead of showing the top SERPs, they show the bottom ranking results.

This info is meant to poison the scraper’s database.

How This Poisoning Affects Us

First and foremost, this flip of the SERPs makes Google Search Console data inaccurate.

Hopefully they will remove those flipped hits and just show us the human impressions and ranking. But until they do, we can’t trust what we’re seeing. Here’s a documented report on how inaccurate rank tracking data is now.

Beyond that, we can’t even trust what we’re seeing on any given day anyhow. For the last 2 years GSC has been unreliable due to things like reporting delays and bugs.

Second, if OpenAI, Anthropic, and other popular LLMs get their data poisoned, then what folks see in chatbots is going to be all over the place.

So, expect to see volatility and chaos from here on out with traffic from chatbots except for Google’s AI SERPs.

FYI, this is going to likely affect every business that offers metric analysis too, like Ahrefs and SEMRush. 

And I’m betting that agencies who help folks run ads are going to be impacted negatively too, as they will have nowhere to turn to get accurate info on what your site is ranking for organically.

More Links in Google AI Summary and Overviews

On the surface, the report of Google expanding its AI Summaries and Overviews to include more links in the content sounds great.

However, as this article points out, folks are not really clicking on those links to go deeper.

If people were clicking then “Google would give us click data broken down in the AI performance reports in Google Search Console, which Google still does not do.”

Google is also including more carousels in AI results.

The point of this is to give publishers more clicks. We’ll see if it works.

But to me, it looks like Google is replicating the way SERPs used to look before AI results, but including Rich Snippets in them too.

This experiment may turn into more clicks for us as they refine it.