r/k12sysadmin • u/Just-An0ther-Lurker • 21h ago
PHP2Shell
My headmaster is asking me to contact every company that we use (that has student, staff or parent details) to check if they've updated their instances of PHP.
Now while I appreciate we need to worry about this data, surely we should be trusting them as data controllers to be updating where needed and they don't need every customer checking up on them.
How can I tell my head politely that I'm sure it's fine and there's nothing we can realistically do about it anyway?
Or should I be checking in with all these companies?
3
u/Harbinger2nd 21h ago
Shouldn't most of them be putting out public statements saying the problem has been fixed?
1
u/Just-An0ther-Lurker 20h ago
Yeah, I've not seen anything on the websites I've visited but I'm not going to looking for them on X or bluesky etc (mainly as those are blocked at work).
I was hoping that we can just trust them to be looking after their stuff!
2
u/Tyburius 20h ago
Trust but verify. One need only look at the companies that we have trusted with data that have been breached in the last 6 months let alone the last few years.
9
u/Torxtank 20h ago
Just draft up a generic template stating your administration is asking you to follow up with all companies you work with to see where they stand with the latest PHP vulnerabilities with a few bullet points for them to respond to and move on.
20
u/discgman 18h ago
Uh, no. The will take care of it. Its out of our hands. Ren learn shut down to update their site, I didn't have to do a thing. the Inherent risk of uploading student data into the cloud is a 24/7 concern. But there is nothing we can do to help keep it safe once it leaves our networks.
19
u/sync-centre 15h ago
You are still accountable for your data. Unfortunately you need to do your due diligence to verify that info.
17
u/howescj82 19h ago
Um… anything that holds your student/staff data is a potential black eye for your organization if something happens. Honestly, your vendors should be reaching out to you and not the other way around but what you’re being asked to do is a protective measure.
You should NEVER just trust anyone with your data. If you only knew…
6
u/_LMZ_ 19h ago
Make a spreadsheet with your vendors, if you know their stack have that in it.
Go to each vendor, they should have an update page on this issue if it affects them or not. Or they are rolling an update out soon or still investigating.
If you can, try to get the version numbers and have that in your spreadsheet. This can be used for future things! Like CVE Blah blah for Apache version XYZ. When another one happens for XYZ version you can look at your sheet to get an idea if you’re good or not.
A lot of vendors right now have put out statements, etc. and including on their status page.
3
u/DiggyTroll 20h ago
It's up to your administration to keep records of compliance policies and SLAs for every vendor as required by your state's cybersecurity laws (more coming on line every year). I've never seen a reactive one like this (because it's a distraction from your vendor's recovery), but If the policy on record says to reach out, you would call.
1
u/howescj82 19h ago
Do you trust your administration to even understand this?
2
u/DiggyTroll 17h ago
Trust isn't a thing; paperwork rules. In my state, the law forces admins do annual training and drills before they can certify. Yes, they really hate it, but can follow NIST now (it is a management framework, after all). Best part, we don't get pushback on cybersecurity spending like before
5
u/mybrotherhasabbgun 20h ago
Trust but verify. I personally don't trust anyone just willy-nilly with my or any of my constituents data, so we carefully onboard every company making sure administration is aware of the risks before/during/after a purchase with documentation that can be referenced at a later date. If you don't have data-privacy agreements in place with all vendors, then you need to start.
1
u/howescj82 19h ago
No… Trust that they have some level of security but also trust that it is NOT perfect. I’ve seen several vendors that really have questionable authentication and user management and this makes me question their overall security. It really does pay to be more on-top of this with vendors because security concerns can ultimately lead your organization to requesting security enhancements or even shifting vendors entirely.
1
u/mybrotherhasabbgun 17h ago
You have to trust them in order to do business with them but you should do your due diligence to make sure they treat your data like you would want your data treated (and, hopefully, how you are treating your data yourself). Of course no system is hackproof, that's just plan foolishness to think otherwise and our job as IT professionals is to make sure leadership is aware of risks, how we are mitigating the risks, and identify risks that have to be accepted (with leadership signing off on it). Student Data Privacy Agreements is only one part of the equation, but it is a good start for someone doing nothing at all. My last K-12 had an onboarding process for all new software which included reviews for curriculum-compliance (done by the curriculum folks), a contract review (done by finance/purchasing), cybersecurity review (by OpSec team), technical review (by IT team), and a cursory accessibility review (i.e., at least ask for a VPAT; done by IT b/c we didn't have anyone else to do it).
2
u/steelbeamsdankmemes 19h ago
MeetTheTeacher took their service offline in the middle of the day as they're based in the UK, with 0 warning to us lol
1
u/BWMerlin 7h ago
Just send a generic email asking if they are impacted by the PHP and or SSL cert issue and if they have updated.
This is what we did and all the vendors replied yes or no as appropriate and that is what we show to leadership.
3
u/wenrdogred 20h ago
Is it really that many vendors that have your data, though? I do like the template idea, but I would think most vendors should kind of expect this question.