Global PHP security issue: what it means for PCS customers

The web security issue that made headlines

The issue relates to PHP, a widely used technology that helps power websites, online services and business applications.

Because PHP is used across a large part of the internet, the vulnerability attracted significant attention from cyber security experts, software providers and national security agencies.

Many organisations rushed to assess their exposure and apply security updates. Many websites including banks, broadcasters and government departments were taken offline temporarily as a precaution while fixes were put in place.

How we responded

At PCS, we continually monitor emerging cyber security threats through our established security monitoring and vulnerability management processes. When details of the PHP vulnerability were released, we immediately assessed our systems to understand whether any PCS services could be affected.

We identified that one service, PCS Resource (formerly DepenSys) could be affected. In line with our Information Security Management System (ISMS), we:

• assessed the risk as soon as the vulnerability became known
• immediately implemented the recommended mitigation measures
• applied the official PHP security update as soon as it became available through our hosting platform, with no downtime for our services
• continued with enhanced monitoring to identify any unusual activity

This allowed us to address the issue quickly and maintain normal service for all customers.

Business as usual

Our assessment and monitoring identified:

• no interruption to system availability
• no impact on customer data
• no impact on the functioning of our software services
• no impact on our Customer Support
• no evidence of any attempts to exploit the vulnerability within the PCS environment

For our customers, that meant business as usual. Care teams were able to continue using PCS systems without disruption while our technical teams managed the issue behind the scenes.

Security is an ongoing activity

High profile reports like this PHP issue are a useful reminder that cyber security is about far more than reacting to individual incidents. It’s important to have the right processes, controls and monitoring in place every day.

Security vulnerabilities emerge regularly across the technology sector. What matters is how quickly they’re identified, assessed and managed.
At PCS, protecting your data and services is a priority. We continually monitor, assess and manage security risks through our wider security assurance and risk management processes. This helps us maintain the confidentiality, integrity and availability of the services you rely on.

Our focus remains on keeping services reliable and secure

We continue to monitor the situation with PHP alongside our usual security reviews and we’ll take any further action if required to maintain the security of our systems and services.

While the latest PHP vulnerability generated headlines around the world, for PCS customers the outcome was simple: we identified the potential risk, took action quickly and continued to provide secure, uninterrupted services.

Our commitment to security

We're committed to high standards of security to make sure your records and sensitive information are kept secure and protected on our robust platform. Read more about our information governance and data security in our Trust Centre.

Visit Trust Centre

Previous slide

Next slide