At Sharp Services, we take the security of our customers’ data, and the continuity of their services very seriously. On 20th and 21st of October, two critical vulnerabilities in PHP became public under the name PHP2Shell.
We want to outline the steps we have taken to ensure keep our services safe.
What is PHP2Shell?
PHP is the programming language used by a significant proportion of websites and web applications worldwide. The recently exposed vulnerabilities in PHP could potentially allow an attacker to take control of an affected web server without logging in, which is why the security community treated this threat with the highest priority.
How we responded
Our teams took immediate action once the vulnerabilities were disclosed. We applied additional protection rules in our web application firewall, so that malicious requests are stopped before they reach our servers. Our web hosting platforms have been updated with the security fixes released by the PHP project. In parallel, we identified every internal system that relies on PHP and drew up a remediation plan for each of them, which we follow closely until completion.
Continuous monitoring
Protection does not end with a single update. Our Security Operations Centre continues to monitor our environment and applications for vulnerabilities and for any attempt to exploit them, ensuring that we can respond swiftly should the threat evolve.
Securing the wider supply chain
A strong security posture extends beyond our own walls. We have asked our own vendor network for an overview of where PHP2Shell affects their environments, and we are tracking their responses and remediation actions closely. An independent security rating platform further strengthens our vendor vulnerability management by giving us continuous insight into the security posture of our suppliers, so that the entire chain supporting our services meets the standards our customers expect.
A partner you can rely on
Our customers can count on us to remain vigilant, to act quickly when new threats emerge, and to communicate with transparency.
For questions related to PHPShell2 or other security concerns, please reach out to [email protected].
