10/23/2026
Two critical security vulnerabilities in PHP, the programming language behind millions of websites, could allow attackers to take control of church websites without ever needing a password. GCFA is urging congregations, conferences, and United Methodist agencies to treat the threat as a high priority.
https://www.gcfa.org/resource/critical-php-flaws-could-let-hackers-take-over-church-websites
General Council on Finance and Administration
Critical PHP vulnerabilities could put church websites at risk—even when an outside provider manages them. Security updates are available now. Learn what to ask your hosting provider and how to help protect your congregation’s website and online services.