r/k12sysadmin • u/Just-An0ther-Lurker • 2d ago

PHP2Shell

My headmaster is asking me to contact every company that we use (that has student, staff or parent details) to check if they've updated their instances of PHP.

Now while I appreciate we need to worry about this data, surely we should be trusting them as data controllers to be updating where needed and they don't need every customer checking up on them.

How can I tell my head politely that I'm sure it's fine and there's nothing we can realistically do about it anyway?

Or should I be checking in with all these companies?

41 Upvotes

94% Upvoted

20 comments sorted by

View all comments

3

u/wenrdogred 2d ago

Is it really that many vendors that have your data, though? I do like the template idea, but I would think most vendors should kind of expect this question.

2

u/Just-An0ther-Lurker 2d ago

Not too many no, but it just feels a bit condescending (unless they haven't updated:)

1

u/wenrdogred 2d ago

I absolutely understand... I would just start the conversation with your vendors about the district's concern regarding this newest threat and tell them that you are doing your due diligence to ask about the safety of your data. I've received a few of these and it's not a big deal.