A worldwide security alert involving software that powers websites offers Fishers businesses a reason to check their online systems — and residents a reminder to stay alert to financial scams.

PHP, a programming language used by websites and services including WordPress, released emergency updates Oct. 21 to fix two critical vulnerabilities. The flaws, collectively nicknamed “PHP2Shell,” could allow attackers to take control of affected web servers without a password, potentially exposing sensitive information or disrupting services, according to the National Security Agency.

The NSA urged immediate patching and recommended taking affected systems offline if updates could not be applied promptly. In Switzerland, ETH Zurich temporarily took some PHP-based services offline as a precaution.

For local businesses, the practical step is to contact their website developer or hosting provider to confirm updates and security checks are complete. PHP also issued an Oct. 23 follow-up advisory addressing an additional risk under an unusual combination of settings; providers should review the latest guidance.

Simply visiting a PHP website does not mean a person’s computer or phone needs repair, New Zealand’s National Cyber Security Centre advises.

The website vulnerabilities are separate from the consumer fraud concerns raised by Kyle Pierce, vice president of information security at Everwise Credit Union, which has two Fishers branches. But both highlight the importance of protecting sensitive information.

In commentary provided for Cybersecurity Awareness Month, Pierce warns that artificial intelligence makes familiar scam clues less dependable. Criminals can produce polished messages, impersonate organizations and imitate familiar voices.

“A phone call that appears to come from your financial institution or a desperate plea from a family member might not be what it seems,” Pierce writes.

One warning sign remains especially useful: pressure to act immediately.

Pierce recommends ending unexpected conversations requesting money or personal information, then contacting the organization through a trusted number or website. Contact details supplied in the suspicious message should not be used for verification.

He also urges consumers to review account activity regularly and promptly report unfamiliar transactions.

Anyone who suspects they have shared sensitive information or sent money to a scammer should contact their financial institution or card issuer immediately, Pierce writes. Embarrassment should not delay a report.

His central advice: pause long enough to question the request before acting.