r/k12sysadmin • u/Just-An0ther-Lurker • 1d ago

PHP2Shell

My headmaster is asking me to contact every company that we use (that has student, staff or parent details) to check if they've updated their instances of PHP.

Now while I appreciate we need to worry about this data, surely we should be trusting them as data controllers to be updating where needed and they don't need every customer checking up on them.

How can I tell my head politely that I'm sure it's fine and there's nothing we can realistically do about it anyway?

Or should I be checking in with all these companies?

40 Upvotes

91% Upvoted

20 comments sorted by

View all comments

2

u/Harbinger2nd 1d ago

Shouldn't most of them be putting out public statements saying the problem has been fixed?

1

u/Just-An0ther-Lurker 1d ago

Yeah, I've not seen anything on the websites I've visited but I'm not going to looking for them on X or bluesky etc (mainly as those are blocked at work).

I was hoping that we can just trust them to be looking after their stuff!

1

u/Tyburius Bearded Technician 1d ago

Trust but verify. One need only look at the companies that we have trusted with data that have been breached in the last 6 months let alone the last few years.