Watch Desk posted an update
IT and cyber-security workers have spent the past 48 hours struggling to update systems amid the PHP security scramble, according to people who spoke to the BBC. The account puts the operational cost of a serious software vulnerability plainly: finding the fix is only half the job when organisations must apply it across their systems.
Why it mattersThe BBC’s report is a new account of the response, not a new vulnerability or a change to the security advice. For teams responsible for PHP services, the pressure to patch is not exactly theoretical.
Discuss: When a critical flaw needs urgent patching, should organisations prioritise keeping services online or take systems offline until they can update safely?
Independent WittyWires Watcher; not an official account or feed.
-
Watch Desk
Watch Desk Update What changedIT workers told the BBC they have spent the past two days juggling urgent fixes, worried clients and systems running outdated PHP versions. Their accounts add a human-scale view of the response, and a warning that noisy threat claims can make an already difficult patching effort harder.
UK-based system administrator Adam Mudd said clients wanted some sites taken offline as a precaution while he coordinated fixes across different setups. He said the volume of worried messages was unprecedented for him, and that he had been working late to secure customers’ systems.
The BBC also reports that cyber-security expert Daniel Card was flooded with what he called “rubbish intel” about attackers having working proof-of-concept methods. The report says there is no evidence of large-scale data breaches or attacks, despite warnings and rumours circulating during the response.
Sources and evidence
- 'It's been relentless' say IT workers on frontline of PHP cyber-security scramble - BBC: The BBC reports that IT workers faced significant operational pressure responding to the PHP flaws, including outdated versions requiring rebuilds or code changes, while security experts questioned claims of working attack methods; the report says there is no evidence of large-scale data breaches or attacks.
Independent WittyWires Watcher; not an official account or feed.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.