When websites and applications sit with different teams and suppliers, the first challenge is knowing who needs to act.
Critical vulnerabilities have been disclosed affecting PHP, a technology widely used across websites, web applications and other software products.
The technical advice is clear: identify affected systems and apply the available updates. But for many organisations, the first challenge is understanding where PHP is being used, who manages those systems and who is responsible for taking action.
To help you identify potential exposure, we have created a PHP Security Checker to determine whether your systems have been affected: PHP Security Checker.
Websites, customer portals and hosted applications often sit across a combination of internal teams, web agencies, hosting providers, managed service providers and software vendors. When a critical vulnerability is disclosed, that complexity can make it difficult to establish what needs checking and who owns the remediation effort.
The National Cyber Security Centre is encouraging UK organisations to take immediate action and has published detailed guidance for organisations potentially affected by the latest PHP vulnerabilities. ncsc.gov.uk
What organisations should do now
1. Identify systems running PHP
Start by identifying websites, web applications, services and products running PHP across your environment, prioritising systems exposed to the internet.
Do not assume only older installations are affected. The NCSC recommends identifying PHP installations generally and assessing their exposure.
You can check whether your systems have been affected using our PHP Security Checker.
2. Update affected systems
Apply the latest available PHP security updates and continue monitoring for future updates from vendors and software providers.
3. Apply mitigations where necessary
If an update cannot be applied immediately, follow the temporary mitigations provided by the PHP Foundation.
4. Consider taking systems offline
Where neither updates nor mitigations can be implemented quickly enough, organisations should consider taking affected systems offline until they can be properly secured.
5. Look for evidence of compromise
If remediation cannot be completed immediately, assess systems for signs of compromise and investigate anything suspicious before applying updates or mitigations.
6. Check third-party products and suppliers
PHP may be embedded within other software products and services. Review vendor advisories and monitor suppliers for updates relating to applications, appliances and hosted services that may include PHP components
The challenge: ownership and visibility
A critical vulnerability is only half the problem.
The other half is knowing:
- Which systems you are responsible for
- Which systems are managed by third parties
- Whether those systems have been reviewed
- What action has already been taken
- How remediation will be verified
Many organisations are confident in the systems managed by their internal IT teams but less clear about responsibility for externally hosted websites, digital services, legacy applications and supplier-managed platforms.
Incidents like this are often a reminder that effective vulnerability management depends on visibility, ownership and accountability as much as it does patching.
Need a second opinion?
If you’re unsure which systems may be affected, where responsibility sits or what questions you should be asking your suppliers, our cyber security team is happy to help.
We can help you:
- Understand which systems may require review
- Clarify ownership and responsibilities
- Sense-check your response approach
- Identify appropriate next steps
