PHP problems were just the start: You need to start planning for a winter of discontent

Two weeks ago, PHP hit the news. Everyone heard how a PHP flaws allowed unauthenticated users to run things locally on the machine that has PHP installed on it. This is less than ideal at the best of times, but if you happened to have a computer on the Internet that is directly accessible then it is really bad, as anyone can now run things on your computer. 

Governments and organisations took a pretty basic step: just unplug the system from the internet as reported by the BBC for example. I don’t have a problem with this response: not only is it appropriate but something I have always said to my bosses. I need the ability to kill any service, and to justify it later, but as the person running the IT infrastructure that is something I have the ability to do with out checking with people higher up.

The PHP issue and to a lesser extent the Heartbleed Bug that came before it, are big computer issues that have hit the mainstream and required the famous Churchillian red sticker stating “Action this Day”. That is, we don’t go home until something is done, even if it that means turn off the systems rather than patch or mitigate. We leave it safe, that’s what matters.

How to keep your infrastructure safe

And here’s the big question: how exactly do we keep the company safe?

It’s useful to think of the software “bill of materials”. This is the list of software or modules that’s built into other software, so when you install one software package you are also installing another. In this case, PHP is everywhere.

If you install a web content managing package like WordPress then you’re also installing PHP on the system. You may not realise, but it’s there. And if you don’t know it’s there, how can you keep it up to date?

Qualys, a security firm, put out a blog post listing PHP versions that it can see. This showed 71% of PHP installations are End of Life versions, which means there is no direct update to a working safe PHP version. I’ve since seen other firms suggest the average is closer to 50%, but either way does anyone out there believe that these systems are being managed correctly?

The law of averages says there’s a one in two charge that any admins reading this are at risk. So now you know how likely it is that you have an issue, please fix it!

Unfortunately, there is no way that everyone is going to. These systems are going to sit on the Internet as bots and spam systems until they’re retired or break.

PHP is a long-term problem… and it’s not alone

The problems in PHP weren’t newly discovered. These issues were raised over a year ago. But back then, they were considered a non-issue as they couldn’t be exploited to cause problems.

You may think how foolish, but every piece of software has known bugs that won’t be fixed. It’s the nature of complex software that they exist, so don’t think this is a rare thing.

What’s different here is that in August an AI found a way to exploit the PHP problems, which turned into the issue we have today. 

You note I said August. At that point, the secret was only known by a small team, who worked on a fix. I suspect that, in the run up to the planned release of the fix, it was opened up to a wider group of people, one of whom leaked it before everyone was ready.

More to come

I hear rumours of many similar issues in the pipeline. Ones so bad that they’re being fixed in secret and will be announced shortly.

I don’t have any inside information here. It could be PHP, it could be in something else. Either way, my warning to you now is this: find out what software you’re running and where. Find out the versions and if they’re current. If not, upgrade them.

Go further still. Do they have software built into them that you should be paying attention to?  If you don’t know, you can’t fix it.

And you need to do this on your laptops, servers, switches, routers, NAS drives, websites, that little widget sitting on the internet.

Speak to your ISP, MSP, cloud application provider. Check what they do if they have an issue like this, document it all. 

You should be doing this already, but if you’re not then start now. Winter is coming and you will want to be ready, as Churchill said, to “Action this day” when the next inevitable announcement comes.

More articles by IT manager Michael Dear

• Password best practice: If someone asks you for random characters, they’re doing it wrong
• When it comes to keeping up with AI-powered updates, we need to move from human speed to machine speed
• IT managers vs Mythos: Get ready for six months of update hell!