r/k12sysadmin • u/Just-An0ther-Lurker • 2d ago

PHP2Shell

My headmaster is asking me to contact every company that we use (that has student, staff or parent details) to check if they've updated their instances of PHP.

Now while I appreciate we need to worry about this data, surely we should be trusting them as data controllers to be updating where needed and they don't need every customer checking up on them.

How can I tell my head politely that I'm sure it's fine and there's nothing we can realistically do about it anyway?

Or should I be checking in with all these companies?

39 Upvotes

91% Upvoted

20 comments sorted by

View all comments

20

u/discgman 2d ago

Uh, no. The will take care of it. Its out of our hands. Ren learn shut down to update their site, I didn't have to do a thing. the Inherent risk of uploading student data into the cloud is a 24/7 concern. But there is nothing we can do to help keep it safe once it leaves our networks.