NetWatch Update: Global PHP Vulnerabilities
Following the disclosure of critical PHP vulnerabilities, we patched Rapid and our website within hours. Downtime was minimal, and no data was affected.
Paige Varley
Customer Success Manager
On 21 October, critical security vulnerabilities were disclosed in two of the most widely used technologies on the web: PHP, through a pair of flaws now known as PHP2Shell, and Node.js. Both are used in parts of NetWatch's platforms, as they are across a large share of the internet.
As a precaution, we took our Rapid platform, our .com website and our legacy Rapid Police Reports platform offline until they could be patched and reintroduced securely. This was essential to protect the sensitive data our platforms access, and to maintain the trust our customers place in us.
We can confirm that no data was affected.
No organisation that builds software is immune to issues like these. Vulnerabilities are found in widely used technology all the time, and when they are, what matters is how quickly and carefully you respond. We want to be open about what happened and what we did.
Rapid platform: Rapid was taken offline at 18:02 on 21 October and was back online at 19:47, having been safely patched. Downtime was kept to a minimum, and customers can access the system safely and securely.
NetWatch website: Our main .com website was also patched and back online at 20:26.
Legacy Rapid Police Reports platform: We have taken the decision to shut down the legacy Rapid Police Reports site. It was already due for imminent closure following the migration of the final client using the system, and we are not confident it could be reintroduced safely without significant and disproportionate work.
"Working in technology means vulnerabilities like these will always come along. Nobody can promise they won't, but we can promise how we'll respond. We acted quickly, chose a brief outage over any risk to our clients' data, and made sure everything was fully patched before we came back online. We'd rather be open about that than pretend it doesn't happen."
- Adam Nimmo, CTO, NetWatch
Overall, downtime for our clients was kept to a minimum, and Rapid is online and secure.
"I'd like to thank the members of our engineering team for their swift response to this vulnerability, and for working late into the evening to ensure that operations can run smoothly for all our customers this morning."
- David Purcell, Chief Operating Officer
What happened
PHP2Shell is two critical vulnerabilities in PHP itself, not in any particular application built on it. They could allow an attacker to run code on an affected server without logging in. Details leaked ahead of the planned disclosure, so the PHP project brought its fixes forward, and the UK's National Cyber Security Centre advised organisations to consider taking offline any system that couldn't be patched immediately.
On the same day, Node.js released fixes for several vulnerabilities, some of them rated high severity.
How we responded
As soon as the fixes were available, our engineering team:
- Assessed which of our services were affected.
- Took Rapid and our marketing site offline as a precaution. A short, planned outage was better than leaving any period in which our services could be exposed. Our clients trust us with sensitive information, and protecting it comes first.
- Applied the patches to every affected service.
- Checked everything before bringing it back. Services came back online only once they were fully patched.
- Reviewed our systems for signs of compromise and found no evidence of exploitation or unauthorised access.
Any customers requiring further information should contact their account manager at NetWatch.
Sources: