Trendz³ Newsletter: IT Drama from PHP2Shell & Marvel's VisionQuest

Hi Friend,

This month's newsletter is all about vision, in three distinct ways:

• 👀 Having your eyes wide open about a new cyber threat out there
• 💠 IT lessons we can learn from Marvel's VisionQuest series
• 🌅 Looking ahead to the start of a new IT year

We think you'll agree after reading, vision has never played such an impactful and indeed versatile role in business technology and cybersecurity.

Sincerely,

Trend¹ — What is all the fuss about PHP? And should your business be concerned?

It may feel like it takes a PhD to understand PHP, but, nah, it's not that complicated.

As you probably know, many of the world’s biggest websites — think: Wikipedia, the BBC, and many government websites — took themselves offline when details leaked in late October about a dangerous flaw in PHP-powered websites.

This "PHP2Shell" bug, which had existed for over a decade before finally being spotted by AI scans this summer, is a big deal because it means hackers can literally take over a website’s server and steal sensitive info like user passwords and encryption keys. Worse, hackers are actively exploiting this flaw — right now.

PHP is an open-source programming language that powers 7-of-10 websites today, including websites built on hyper-popular WordPress. You — yes, you — interact with PHP most every day, as you're logging into online portals, paying on e-commerce platforms, and completing website forms.

The pressing question is: Is your website vulnerable? It could be, if it was built on WordPress, Joomla, Drupal, or another CMS using PHP. See the resource section below for a link to a free PHP website scan.

And what if you have a WordPress or otherwise PHP-powered site? We recommend contacting your web hosting provider to ensure they have applied the emergency patches. They probably have, but we'd get that peace of mind.

Trend² — IT lessons to marvel at: 5 takeaways from the VisionQuest TV series (no spoilers)

With episode names like "reboot," "malware," and "firewall," you know Marvel's latest TV series — VisionQuest — must contain plenty of fodder for an IT newsletter like this one. Not to mention, when you work for a technology business as we do, there's bound to be a real Marvel nerd or two floating around the workplace.

Whether you're a fan of the superhero genre or not, here are 5 IT lessons we should all learn from VisionQuest. Don't worry — no spoilers here.

Just for fun: Did you make a connection between a lesson/Easter egg below and a VisionQuest scene? Tell us about it here; we'd love to nerd out.

5 VisionQuest IT Lessons: 

• 💠 Sometimes you just need a good reboot (no swimming pool necessary). When things go awry with your phone, computer, or other tech, perhaps your screen freezes or everything slows to a crawl, first simply "turn it off and on again." This often works because a restart clears temporary memory and stops glitchy background processes, so the device starts over clean.
• 💠 AI can be a friend or foe. Whether generative or agentic, AI is your friend...until, well, it's not. Make sure AI treats you more like a F.R.I.D.A.Y. than a Monday by keeping sensitive data out of AI tools, double-checking output before acting, and limiting what agents can do without your approval.
• 💠 Be careful what you post on social media. Because even something as simple as a picture of your adorable French bulldog can be used by hackers to stage phishing attempts and to guess passwords, which leads to...
• 💠 Use long, unique passwords. You needn't be a big organization like Interpol; bad actors are out to hack systems of all sizes. And simple passwords, especially when you leave clues online, are a big mistake.
• 💠 Legacy systems don't just go away. Businesses are often full of outdated technology such as aging servers, Windows machines with expired support, and old accounts nobody remembered to turn off. So, here's some Old Technology for D.U.M.-Es kind of advice: Inventory your tech at least once a year, then update or replace anything that no longer gets security updates.

Trend³ — Got a tech wishlist? There's no better time for IT and cybersecurity upgrades

Speaking of legacy systems ... and updating or replacing outdated technology. The reminder from VisionQuest couldn't come at a better time, because — guess what? — right now, for many companies, is the ideal season for making IT purchases.

Without even so much as the cost of postage to the North Pole.

3 reasons why Q4 is go-time for IT purchases:

1. Leftover IT budget: You made the allocation for a reason, yet many businesses may have money left in this year’s budget — that disappears on Dec. 31. Now may be the optimal time to spend it because...
2. Tax write-offs: Section 179 lets businesses deduct the full cost of qualifying hardware and software in the year they're put to use. Buy and set up by year's end, and you may see savings on this year’s taxes. (Check with your CPA.)
3. Prices continue to climb: An AI-driven memory chip shortage is pushing up the price of, well, all computers. And prices are expected to continue rising for the foreseeable future. Waiting probably won’t get you a better deal.

Replace anything that no longer gets security updates first, and leave time to set it up before Dec. 31 if you’re counting on the tax deduction. When old devices go out, wipe or destroy the hard drives, because old computers still hold your data.

And, as always, just let us know if you have questions.

Is your website vulnerable to the PHP2Shell security flaw? Scan it for PHP — free

You already saw in trend one how dangerous the PHP2Shell security flaw can be to a business — giving hackers an open door to hijacking your website's server and, among other things, an avenue to stealing passwords and encryption keys.

It's website warfare. So, fight back with another website. PatchMyPHP.com will scan your site for PHP and, by extension, any known PHP2Shell concerns.

Visit PatchMyPHP to Scan Your Site

Hacker group claims to have breached NWA-based J.B. Hunt — and stolen millions of files

What (allegedly) involves over 140,000 employee records, 1.7 million carrier contacts, 38.2 million invoices, and 973 email mailboxes? A cyberattack on NWA-based J.B. Hunt, that's what, claimed by hacker group WhiteArmor.

The trucking company hasn’t confirmed those details, but it did tell 5NEWS:

"We are investigating a cybersecurity incident involving unauthorized access to certain information within an isolated portion of J.B. Hunt’s technology system. Our systems remain operational, and there has been no disruption to our ability to serve customers..."

WhiteArmor has reportedly demanded a $5 million ransom and posted data samples online, and current and former employees have filed at least four class action lawsuits against J.B. Hunt.

Read More About the Data Breach

Articles We're Reading...

Here's four articles we've read recently with important implications for small business — and their technology, productivity, and/or cybersecurity.

• New York Knicks sent employees fake offer of championship rings in phishing test: Report
• Hacker claims ‘123456’ password let them breach Danish national registry and 8.8 million records
• CSO: Binance heist is stark example of AI governance gaps and basic security failures
• Governments are hacking people with ‘zero-click’ spyware by showing them online ads

Get Trendz³ Sent Directly to Your Inbox! 

Trendz³ is a free, monthly email newsletter from TekTrendz, created exclusively for small businesses of Northwest Arkansas. Once a month, the Trendz³ newsletter will provide you with a quick rundown of the three most pressing trends in technology, cybersecurity, and IT — that you really need to know. We'll also share helpful resources and news along the way.

It's the IT newsletter designed for you. Click below to sign up today. It's free.