PHP security vulnerabilities: Legal considerations for your organization

Organizations around the globe moved quickly this week to respond when critical security vulnerabilities were recently disclosed in PHP, a programming language widely used to run websites and web applications. While a patch was released quickly, the exposed flaws affected a wide range of websites, including government services in several countries that were temporarily taken offline. In Canada, the Canadian Centre for Cyber Security issued an alert on the vulnerabilities (AL26-026).

Beyond the technical fix, these vulnerabilities raise legal questions about breach reporting, security obligations, vendor contracts and insurance.

What happened

PHP is a programming language most commonly used in website development. When someone visits a page, logs in or submits a form, PHP code processed on a web server often does the work of building that page and handling the sending and receiving of information.

The identified vulnerabilities could allow attackers to take over web servers and access data. A patch is available, but older versions of PHP will not receive the fix, so unpatched and legacy systems remain at risk.

Legal considerations and practical steps

Organizations may be using PHP without realizing it. The simplest first step is to confirm with your IT provider whether your systems use PHP and whether the fix has been installed. Questions about whether the flaw was exploited, whether personal information was accessed and what must be reported are legal questions, and are best answered with legal counsel involved from the outset.

Organizations should consider the following legal steps:

• Assess breach reporting obligations – Canadian privacy laws generally require organizations to report a breach that creates a real risk of significant harm and to do so promptly once that determination is made. Delay in assessing a potential breach can itself create risk. Speak with legal counsel early about whether reporting to regulators or notification to affected individuals may be required.
• Document reasonable security – Organizations are required to maintain reasonable security, and prompt patching can be evidence of that. Government cybersecurity agencies recommend prompt patching. Organizations that delay, or do not know whether they run PHP, may find it harder to show their security was appropriate.
• Review vendor contracts – Most organizations rely on hosts or service providers to maintain PHP. Now is the time to review your vendor contracts and what they say about who is responsible for maintenance, how fast it must be done and who bears the cost of downtime and breach response.
• Notify your insurer if required – Cyber insurance policies typically require early notice of circumstances that could lead to a claim. Review your policy and speak with your broker or legal counsel about whether insurer notification may be required and whether your policy gives you access to breach response counsel.

• Keep records and protect privilege – Keep a record of when a security flaw is identified and the actions taken in response. Where a breach is suspected, consider retaining legal counsel to direct any forensic investigation so that sensitive analysis and advice may be protected by privilege.

How we can help

Our Technology, Intellectual Property and Privacy team works with private and public sector organizations on these issues. We can help you:

• Direct a privileged investigation into whether your systems were affected, working with forensic and IT providers
• Determine whether an incident is reportable, and to whom
• Communicate with regulators and insurers
• Review vendor, hosting and processor contracts
• Assess your exposure under data protection, cybersecurity and product regulations
• Develop or review incident response plans and documentation practices that stand up to scrutiny
• Work with you to improve your compliance programs to minimize risks to your organization going forward.

If your organization was affected by the PHP vulnerabilities, is unsure whether it was or wants to be better prepared for the next one, contact our team. Early involvement of counsel can help preserve privilege and meet reporting timelines.

Share