You may have seen recent reports of a security issue affecting PHP, a technology widely used to power websites and web applications. We wanted to share some clear, practical guidance to help you understand what this means for your organisation and what steps to take.
What has happened?
Two serious vulnerabilities have been identified in PHP. Security updates have now been released, and hosting, software and application providers are assessing their exposure and applying the relevant updates.
Am I affected?
Not every website or application that uses PHP is vulnerable. Whether a service is affected depends on factors such as the PHP version in use and how the service is configured. Using PHP does not, by itself, mean that a website or service has been compromised.
In practice, it can be difficult to determine this yourself, particularly where websites and applications are hosted or managed by third parties. Trying to identify every use of PHP across your organisation or wider supplier base is unlikely to be straightforward or particularly useful.
What we recommend
- Focus first on your critical and internet-facing websites and applications.
- Contact the provider responsible for hosting or managing each of these services.
- Ask them to confirm whether the service is affected by these vulnerabilities.
- If it is affected, ask them to confirm that the appropriate security update or mitigation has been applied.
The provider responsible for a service is the most reliable source of assurance, as they can confirm both whether it is affected and whether it has been remediated.
What we are doing
We have undertaken the same assessment across the tools and services we use to support and deliver services to our customers. Based on that assessment, we are satisfied that these services are either not affected or, where applicable, the necessary remediation has been completed.
We are continuing to work with our suppliers and monitor the situation as it develops.
How TSG can help
We appreciate that identifying whether a service is affected, or understanding the technical response from a supplier, may not always be straightforward.
If you need help understanding your potential exposure, reviewing the position with one of your providers or determining what action may be required, please get in touch. Your account manager or our support team will be able to help and bring in the appropriate technical expertise where needed.
You can also find this guidance on the Connect 365 login page.
We will continue to monitor the situation and update our guidance as needed. If you have any questions, please contact your account manager or our support team on 0333 220 0777 or email techsupport@tsg.com.
-2.svg)
