The National Cyber Security Alert, how to stay safe online

A "Critical Alert - Act Now" was issued today by the Australian Cyber Security Centre, part of the Australian Signals Directorate.

Some websites are built with a common tool called PHP and two serious faults have been found in it. The people who run those websites need to urgently install a fix.

Think of a website as a house. PHP is one of the most popular sets of building materials. A great many websites use it, including WordPress, which many clubs and small organisations use.

The experts found two faults in PHP. A fault like this is called a "vulnerability", which means a weak spot a criminal could use to break in. The fix is called a "patch". The makers of PHP planned to release the full details at midnight Queensland time, on the night of Wednesday 21 October.

Some details leaked online a little early, as reported by the security news site Decipher. A web security firm called Sansec expects criminals to start targeting these weak spots very soon. So far, the Cyber Security Centre says it knows of no attacks.

Sansec also says the fix to the problem has to be done by the website, by whoever runs it. It is not something you can fix on your own computers or phones.

We have checked all CAQ websites. That includes the main croquetqld.org site, myCroquet, ClubHub, the News site and Come and Try.

Fortunately, none of them are built with PHP. This alert does not affect our sites at all. You can keep using myCroquet and reading the news just as you always have.

All Croquet Queensland websites are safe from this problem because they are built with newer tools that don't use PHP.

CAQ keeps its software up to date and acts quickly on security alerts.

Even though CAQ websites are fine, other websites you use, such as booking or membership sites, may run on PHP and could be at risk in the coming days.

These types of big security stories are a good reminder that we must look after our own accounts. Here are six important habits that will improve your online safety.

Line drawing of older hands holding a phone (A code sent to your phone is one of the easiest ways to keep an account safe.)

1. Say yes to updates. When your phone, tablet or computer asks to update, let it. Updates often fix security problems. Try not to put them off for days. 2. Turn on the second login step. This is often called two-step verification. After you type your password, the website sends a code to your phone. Switch it on for your email, your bank and any club accounts. A grandchild or friend can help you set it up. 3. Use a different password for each important account. That way, if one website is broken into, your other accounts stay safe. A password manager, which is an app that remembers your passwords for you, makes this much easier. 4. Be wary of "urgent" messages. Criminals copy real alerts like this one. If an email or text makes urgent security warnings or says "act now", do not click the link. Type the website address in yourself, or ask someone you trust. 5. Ignore password resets you did not ask for. Over the next while, watch for fake emails saying "reset your password" or "your account is locked". If you did not ask for it, delete it. 6. Keep an eye on your cards. Check your bank statements for payments you do not recognise. You could also keep a separate "online" card with just a few hundred dollars in it, and use only that card for shopping online. Ask your bank about it if it sounds like a good idea.

If you think you have been scammed or hacked, call the help line on 1300 CYBER1 (1300 292 371), or report it at ReportCyber.

And as always, if an email seems suspicious, whether it comes from CAQ or anyone else, contact the sender a different way, for example by phone or a fresh email, before you click any link.