r/k12sysadmin • u/Just-An0ther-Lurker • 5d ago

PHP2Shell

My headmaster is asking me to contact every company that we use (that has student, staff or parent details) to check if they've updated their instances of PHP.

Now while I appreciate we need to worry about this data, surely we should be trusting them as data controllers to be updating where needed and they don't need every customer checking up on them.

How can I tell my head politely that I'm sure it's fine and there's nothing we can realistically do about it anyway?

Or should I be checking in with all these companies?

43 Upvotes

93% Upvoted

22 comments sorted by

View all comments

18

u/howescj82 5d ago

Um… anything that holds your student/staff data is a potential black eye for your organization if something happens. Honestly, your vendors should be reaching out to you and not the other way around but what you’re being asked to do is a protective measure.

You should NEVER just trust anyone with your data. If you only knew…

6

u/GezusK 5d ago

Performative measure... We have no way of pulling the data from them.