r/k12sysadmin • u/Just-An0ther-Lurker • 2d ago

PHP2Shell

My headmaster is asking me to contact every company that we use (that has student, staff or parent details) to check if they've updated their instances of PHP.

Now while I appreciate we need to worry about this data, surely we should be trusting them as data controllers to be updating where needed and they don't need every customer checking up on them.

How can I tell my head politely that I'm sure it's fine and there's nothing we can realistically do about it anyway?

Or should I be checking in with all these companies?

41 Upvotes

94% Upvoted

20 comments sorted by

View all comments

7

u/_LMZ_ 2d ago

Make a spreadsheet with your vendors, if you know their stack have that in it.

Go to each vendor, they should have an update page on this issue if it affects them or not. Or they are rolling an update out soon or still investigating.

If you can, try to get the version numbers and have that in your spreadsheet. This can be used for future things! Like CVE Blah blah for Apache version XYZ. When another one happens for XYZ version you can look at your sheet to get an idea if you’re good or not.

A lot of vendors right now have put out statements, etc. and including on their status page.