Ian Ashton

They posted a link as well You can also check this page for further details on the situation.

Had this in an email from Prestashop. Is it an issue for Thirtybees? <——————————————————————- We have recently identified a security threat affecting some online stores within the PrestaShop ecosystem. A malicious script (“digital skimmer”) has been detected and may have led to the theft of customers’ payment information. This malware operates by replacing the legitimate payment buttons on the checkout page with fraudulent ones. When a customer clicks on one of these fake buttons, they are redirected to a counterfeit payment form designed to capture their bank card details. At this stage, we strongly recommend that you contact your PrestaShop expert agency or PrestaShop Support as soon as possible to perform a thorough security check of your store and ensure it has not been compromised.

Many thanks. That's what's happened. Order restored ;-))))

Just to clarify - my live store is on PHP 8.3 and TB 1.6.0 and appears to be working. what I don't understand is why Advanced Parameters/Configuration Information reports Build for PHP version: 8.1 Your server is running on PHP version 8.3.25. You should use core updater and fix your installation HOWEVER running Core Updater doesn't do anything but says "Your system is up to date! No further actions are required" ?

I did try the update on my test installation which ran OK. Advanced Parameters/Configuration Information report below. I'm not sure about "Install the 'yaml' PHP extension on your server " as its a shared server so PHP managed by the ISP. CONFIGURATION INFORMATION This information must be provided when you report an issue on github or forum. SERVER INFORMATION Server information Linux #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 Server software version Apache PHP version 8.3.25 Memory limit 128M Max execution time 120 DATABASE INFORMATION MySQL version 5.6.51-log MySQL server IP MySQL name TB NAME MySQL user TB USER Tables prefix prefix_ MySQL engine InnoDB MySQL driver PDO STORE INFORMATION Thirty bees version: 1.7.0 Thirty bees revision: f1c64a1600692325f6ff2621edb590519bf7c2ca Build for PHP version: 8.3 Shop URL DOMAIN Shop Root Directory: ************************ Current theme in use community-theme-default YOUR INFORMATION Your web browser Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 CHECK YOUR CONFIGURATION Some required tests failed Install the 'yaml' PHP extension on your server

Is it OK to switch to 1.7 to test this and then revert to 1.6? Or Should I stay on 1.7? It's just that I'm doing it on the live shop. If 1.7 is nearly live then I'm OK staying on it.

As my ISP moves PHP along I occasionally have to update Thirty Bees to stay in step My order of play was Log into BackOffice Move site to PHP 8.3 on my Control Panel Run Core Updater [ 1.6.12 ] Set target to PHP 8.3 Run Core Updater/Check Updates followed by Update Site Then in BackOffice looked at Advanced Parameters/Configuration Information which reported Thirty bees revision: 1.6.0 Build for PHP version: 8.1 Your server is running on PHP version 8.3.25. You should use core updater and fix your installation BUT now running Core Updater says Core Updater/Check Updates => Your System is up to date! Your system is up to date! You are already using latest stable version 1.6.0. No further actions are required. So did anything happen? Shop seems to be working OK. Why the mismatch between Core Updater and Advanced Parameters/Configuration Information?

I did have the No Captcha reCAPTCHA Module installed BUT not activated for Registration - so I've now done that. Many thanks. What's your take on Cloudflare+Turnstile ? Do You think Turnstile will appear in Thirty Bees in the future?

Over the past few days ( 1-10 dec 2025) we've been getting 'bogus' customer registrations. Problem: Bogus Registrations.pdf No orders or addresses. They come from a selection of IP addresses - some of which appear in blacklists. The Name and Surname fields look very odd. Or it's just a BOT generating random strings. The emails look valid - stolen from somewhere else??? Anyone else seen this? Can we do anything about it? Just deleting them every day at the moment.

Had a support chat session with my ISP. The engineer supplied credentials of a SMTP server that didn't use authentication or ssl or tls. And guess what - emails sending again! So his conclusion was So once they've sorted out their internal communication problems I'll be back to normal. Thanks for your input.

Yes - the shop can't send any emails at the moment. Which is causing an internal error when TB tries to change the order status without having send the confirmation email. Just noticed the timeout message in the error log so the two messages I see on failure are [Thu Nov 13 14:56:34.288173 2025] [fcgid:warn] [pid 98322] [client 2.126.40.62:53215] mod_fcgid: read data timeout in 60 seconds, referer: https://ashtonjones.uk/adminXXXXX/index.php?controller=AdminEmails&token=9b2bb752062e6115d9196c18d56792bc [Thu Nov 13 14:56:34.288230 2025] [core:error] [pid 98322] [client 2.126.40.62:53215] End of script output before headers: php82-cgi, referer: https://ashtonjones.uk/adminXXXXX/index.php?controller=AdminEmails&token=9b2bb752062e6115d9196c18d56792bc The SMTP settings in the configuration all work for my mail clients on MacOS, iOS and iPADOS When I click send test email on the Advanced Parameters/Email page I get the rotating arrows in the top LH corner of the window then after a minute or so the Internal server error message below the Send Test Email box. So I'm inferring there's a problem contacting the SMTP server. So the problem is communication between TB and the SMTP server so I should be talking to my ISP? If there was a config problem I'd get a password invalid message etc.

Something has changed on my email settings and I'm not sure if its at the ISP end or my end. Was using PHPMailer successfully until a few days ago ssl_errors.log message is [Thu Nov 13 12:43:51.909043 2025] [core:error] [pid 55714] [client 2.126.40.62:15399] End of script output before headers: php82-cgi, referer: https://ashtonjones.uk/admin0XXX87n/index.php?controller=AdminEmails&token=9b2bb752062e6115d9196c18d56XXXXX Does this give anyone a clue as to where I should be looking?

Just had a customer report the polyfill.io malware problem on my site. We're running TB 1.4.0 under PHP 8.1 I ran core updater ( 1.6.8 ) and it reported all OK. I checked header.tpl in the community theme and there's a reference to polyfill.io on line 62. Do I just have to delete this line as a quick fix? Anyone know what the above malware actually does?

My ISP has declared end of life for PHP 8.0 I'm running TB 1.4.0 / PHP 8.0 So do I Log into TB admin in one window. In another window log into my ISP Control Panel. In the Control Panel window update my scripting preference to PHP 8.1 In the TB window run Core Updater and update TB to 1.4.0 / PHP 8.1 i.e. is it OK to change PHP whilst logged into Thirtybees? In fact is this the only way to do it. I assume if I swap to PHP 8.1 before logging in then TB will complain I'm running the wrong version.

Thanks for looking at this. The fix worked on the virgin install (on my local server) and on my online test service.