You will already be aware, recent reports have identified two critical PHP vulnerabilities that could allow attackers to take control of unpatched websites and web applications.
PHP (Personal Home Page, or more recently known as PHP: Hypertext Preprocessor) is one of the world's most widely used web development languages and underpins millions of websites, customer portals, business applications and content management systems, including WordPress.
Following our own internal review, we can confirm that Trustmarque Ultima is unaffected at this time.
We are therefore advising your organisation to treat this as a high-priority security review. Even where exploitation has not been observed within your environment, prompt identification, patching and monitoring will help reduce risk and minimise potential disruption.
If you are a Managed Services customer of Trustmarque Ultima, you will be contacted directly by your Account Manager.
So, what do you need to do?
1. Identify potentially affected systems
Review your estate to identify:
2. Check PHP versions
Determine which PHP versions are in use across your environment and assess whether they are affected by the vulnerabilities.
3. Apply security updates
Install vendor-recommended patches and updates as soon as possible in line with your change management processes.
4. Review exposure
Prioritise systems that are:
5. Monitor for suspicious activity
Such as reviewing Web server logs, security monitoring alerts, unusual account activity and unexpected configuration changes.
Where websites or applications are hosted or managed by external providers, seek confirmation that appropriate patching and mitigation activities have been completed.
How Trustmarque Ultima can help
Trustmarque Ultima customers should work with their account team or managed security contacts to assess whether business-critical systems may be affected, review patching priorities, validate security monitoring coverage and carry out vulnerability assessments where required. TMU can also provide penetration testing to identify exploitable weaknesses in internet-facing websites and applications, helping organisations strengthen protective controls around these services.