PHP raises questions on how (and when) to patch

The life of an IT pro is filled with problems to fix—and sometimes prioritizing which one to tackle first can present complicated challenges.

When OpenAI researchers in October reported they had discovered a vulnerability in open-source scripting language PHP, which powers around 70% of the world’s websites, panic set in across the globe.

To its credit, PHP Foundation quickly pushed out a patch for the vulnerability, which went undetected since 2014. But some organizations, including federal agencies, have been slow to put the patch in place.

Nabil Hannan, field CISO at NetSPI, told IT Brew that part of the delay in patching might be the time involved in tracing PHP in particular systems; locate the problem before you patch.

“Just applying the patch itself is not quite as simple as you would think it would be, especially with complicated software,” Hannan said. “The amount of testing needed and effort that goes into doing regression testing, functional testing, and making sure that once the patches have been applied, that every system downstream is still functioning as expected, takes a lot of effort.”

Long time coming. For IT pros, the need to patch is clear but not always a top priority, and PHP is the latest example of this playing out in the real world, Snyk CTO Manoj Nair explained.

Tracking down every vulnerability and how and where to apply the patch is going to present challenges for even the most skilled IT team, who may face an uphill battle with other stakeholders in their respective orgs.

“The patch being available is, honestly, the easy part,” Nair said. “Not saying that it’s trivial, but then going through that whole process, if you’re an enterprise of any size, you’ve got multiple security vendors; you have to figure out exactly where [it is], and then go through that whole loop.”

Back up. Even once you’ve finished the patch, there’s still work to do. The solution takes time to test on the backend to make sure it worked. As the volume of newly discovered vulnerabilities overwhelms security teams, thanks in large part to AI bots scanning networks, prioritizing what to patch and manage is important, Delinea CEO Art Gilliland said.

“You have to test those patches, you have to make sure when you roll them out, it maintains the effectiveness and the availability of your infrastructure,” Gilliland said. “It’s not just the patching that matters, it’s all of the things you have to do after you’ve patched.”

That post-patching includes making sure the bad guys aren’t already inside the system, that passwords and credentials aren’t compromised, and other basic security hygiene priorities. Identity, Gilliland told IT Brew, is a top priority.

“The most immature environment in most people’s organizations today is their identity security infrastructure,” Gilliland said. “Making sure you’re focused on that area as the next step in the kill chain is really critical; breaking in is one thing, but moving around after they’re inside is the thing you really want to stop.”