Houston Small Business Security Checklist: 6 Monday Fixes

Drafted with AI assistance; reviewed and edited by Carl Gutierrez, founder of Easy Clicks AI.

This week I logged into my Railway dashboard to check on my app.

About 6 months back I installed a small app my nephew had created. It lets me snap a picture of an item. The app sends it to Claude, looks it up on eBay, pulls comparable listings, descriptions, pricing and shipping, drafts a full listing, and sends it back to me to approve before anything goes live. That's a common spot for a small business to be in: someone you know builds you something handy, you install it, and you don't really know what the security looks like underneath. The app runs on Railway, a hosting platform, and like a lot of small apps it stores its keys and passwords right there on the platform as environment variables.

Then the news broke that Railway had been breached, and that the attackers were after exactly those stored credentials, especially API keys for AI providers. So my first move was to open that dashboard and look at what my own app had sitting there.

If my stuff needed checking, there's a decent chance yours does too. This is my small business security checklist for the week: 6 things I'd tell any Houston-area small business owner to do Monday morning.

What are PHP2Shell and the Railway breach?

Two stories matter. First, PHP2Shell. PHP is the software underneath a large share of the world's websites, including most WordPress sites. On October 21 the PHP project released fixes for 2 critical flaws (CVE-2026-109618 and CVE-2026-109619) that, under the right conditions, let an attacker run code on a server without ever logging in. The severity score is 9.2 out of 10, and the foundation that maintains PHP says updating is imperative (their write-up).

Second, Railway disclosed a targeted attack on the systems that store customer environment variables, the same kind my nephew's little app relies on.

1. Is your website exposed to the PHP2Shell flaw?

This is the do-it-before-lunch item.

If your site runs on Wix, Squarespace, Shopify or Vercel, the platform manages the server software for you, so as of this writing there's no PHP for you to patch. My own site is on Vercel. I had it checked this week, and there was no PHP to patch.

If you're on WordPress, you can find your PHP version under Tools, then Site Health, then Info, then Server. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer on the same branch. Double-check those numbers on php.net, since new releases change them. One thing that trips people up: updating WordPress itself does not fix this, because PHP is the layer underneath WordPress.

If someone else built or hosts your site, send them this and get the answer in writing:

"Is the PHP serving my website patched for the PHP2Shell vulnerability disclosed in October 2026? Has the PHP process been restarted since the patch? What is the exact version now? Please also check any staging sites, old subdomains, or other PHP apps on my account."

If you're comfortable with technical tools, OpenAI released a free checker that gives a version-based warning from a site's PHP headers. For most owners, the email above is the faster path.

2. Are text message codes safe enough for your logins?

Codes sent by text message can be intercepted. Someone who convinces your phone carrier to move your number to their SIM card gets your codes with it. An authenticator app (Google Authenticator, Microsoft Authenticator, or the one built into your password manager) generates codes on your device instead, so a SIM swap by itself doesn't hand any codes over. They're not phishing-proof, though. A fake site can still trick you into typing a code in.

Start with your email, then banking, then your website admin and cloud storage. An authenticator app is a big step up from text messages. A hardware security key is the strongest option for the 2 accounts that would hurt the most: your email and your banking.

Authy's parent company disclosed a leak of 33M phone numbers in July 2024. The app is still far better than text codes, but that leak is part of why I'm shopping for a hardware key for my own email and banking.

3. Should your website store customer passwords?

If your website lets customers create accounts, it's worth asking whether you should be holding their passwords at all. Letting customers sign in with their Google account means your site stores far fewer password hashes, which is the biggest liability in the pile, and you inherit Google's sign-in protection and account recovery.

Don't build this yourself. Providers like Clerk, Auth0, Firebase and Supabase exist for exactly this, and a web professional can set one up. 2 honest limits: some customers won't want to use a Google account, so offer an email-link option too, and you still hold customer data either way. This shrinks the worst of your risk. It doesn't erase it.

I sign in with Google wherever it's offered, for the same reason. If your site stores customer logins today, this is a good question to bring your web person this week.

4. Why should you delete old accounts you don't use?

Every account you signed up for and forgot about is your information sitting in someone else's database, and some of those companies might not even exist anymore. Start with the ones holding payment or ID information. One honest caveat: deletion doesn't always purge a company's backups, so while this does shrink your exposure, it doesn't erase it.

5. What is a family code word and why do you need one?

Scam calls are getting good enough that you can't trust a familiar voice by itself anymore. Pick a code word your family can ask for during any urgent call, text or email about money or passwords. It's especially worth doing for relatives over 50. Choose a word that isn't posted anywhere online, and share it only in person or over the phone. The real risk of posting it online is that a scammer researching your family can find it.

The business version is the same idea with a different name: a written rule that any request to change payment or bank details gets verified by calling the vendor at a number you already have, never by replying to the message. At a past office job, phishing emails claiming overdue bills showed up in our inbox constantly, and the good ones looked completely real.

6. Do your backups actually work?

The simple standard is 3-2-1: 3 copies of anything that matters, on 2 different kinds of storage, with 1 kept offline. If you don't know your backup situation, ask your host or IT person 3 questions: what is backed up, how often, and when was a restore last tested. If a restore has never been tested, you don't know whether the backups actually work.

Want a walkthrough?

I put together a prompt you can copy and paste into ChatGPT, Claude, or whatever AI you already use. It walks you through all 6 checks one step at a time, in plain English. It never asks for passwords or codes, it never tells you to run anything technical, and it tells you when to stop and call your web host or IT person instead.

You are my patient small-business security helper. I am not a technical person. Walk me through a basic security checkup of my business, one step at a time. After each step, stop and wait until I say "done" or "skip", or ask you a question. Use plain English. If you have to use a technical term, explain it in one sentence.

Hard rules for you:

1. Never ask me for passwords, passcodes, verification codes, API keys, or recovery phrases. If a step involves one, tell me where to type it in myself. Never ask me to share it with you.

2. Never tell me to run scripts, commands, or code I do not understand. If something needs that, tell me to hand it to my web host or IT person, and help me write the message to send them.

3. If I get stuck or something looks off, tell me to stop and contact my web host or IT person, and help me write down exactly what to ask them.

4. Before we start, tell me clearly: this is general guidance, not a security audit, and no checklist can guarantee safety.

Here are the steps, in order:

Step 1: Check my website for the PHP2Shell flaw (a serious PHP vulnerability disclosed in October 2026). Ask me whether I have a website, and who built or hosts it. If my site is on Wix, Squarespace, Shopify, or Vercel, tell me those platforms manage the server software for me, so there is no PHP for me to patch, and move on to step 2. If I use WordPress, guide me to Tools, then Site Health, then Info, then Server, to find my PHP version. The safe versions are 8.5.12, 8.4.27, 8.3.36, 8.2.35, or anything newer on the same branch. Tell me to double-check these numbers on php.net, since new releases can change them. If my version is older, or I cannot find it, or someone else built or hosts my site, help me send my host or developer this message, and tell me to get the answer in writing: "Is the PHP serving my website patched for the PHP2Shell vulnerability disclosed in October 2026? Has the PHP process been restarted since the patch? What is the exact version now? Please also check any staging sites, old subdomains, or other PHP apps on my account."

Step 2: Turn on stronger sign-in protection (MFA) on the accounts that matter most. Help me list my key accounts: email first, then banking, website admin, cloud storage, and business software. For each one, walk me through switching from text-message codes to an authenticator app such as Google Authenticator, Microsoft Authenticator, or the one built into my password manager. Mention that a hardware security key is the strongest option for email and banking, and that an authenticator app is already a big step up from text messages.

Step 3: Passwords. Ask me whether I reuse passwords across accounts. Recommend a password manager and one unique, long password per account. If my business website stores customer logins, explain in plain English that letting customers sign in with their Google account can mean my site stores fewer passwords, but it is not the right fit for every business. Help me write down questions to ask a web professional about whether it fits my site.

Step 4: Old accounts I no longer use. Help me list services I signed up for and forgot about, and make a plan to delete them, starting with any that hold my payment details or ID information. Remind me that some companies keep backups after deletion, so this shrinks my risk but does not erase it.

Step 5: Scam defenses for my family and my team. Help me set up a code word that family and employees can ask for during any urgent call, text, or email about money or passwords, especially to protect older relatives. Tell me to pick a word that is not posted anywhere online and to share it only in person or by phone. Then help me set the business version: a written rule that any request to change payment or bank details gets verified by calling the vendor at a phone number we already have, never by replying to the message.

Step 6: Backups. Ask me whether I know how my website and important business files are backed up. Explain the 3-2-1 idea in plain English: 3 copies, on 2 different kinds of storage, with 1 kept offline. If I do not know my backup situation, help me write a message to my host or IT person asking what is backed up, how often, and when a restore was last tested.

When we finish all six steps, give me a short summary I can save: what I did, what is left, and exactly who I need to contact for each open item.

Where to start Monday morning

That check of my Railway dashboard is the reason for this list. Some of these 6 checks take minutes to start on your own. Others, like moving customer sign-in or testing a backup restore, are jobs to hand to a professional, and now you know what to ask for.

Sources

• The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security (October 21, 2026)
• PHP 8 ChangeLog and release announcements, php.net
• Railway: Preliminary Report, October 21st Security Incident
• OpenAI: PHP2Shell checker
• Twilio: Security Alert, Authy app (July 2024)