PHP, the language behind WordPress, Joomla, Magento and many shared-hosting sites, has two critical flaws, and hackers are reportedly already exploiting them. Patch PHP as soon as the new version is released. Automatic WordPress updates will not install the fix, so ask your web host or developer who maintains PHP on your site. Cloudflare says its firewall rules are only a temporary stopgap. Until patched, consider taking the site offline if you cannot update it.