We assessed the situation immediately and implemented the necessary security measures. The most important point first: there are currently no indications that any data has been leaked, and the PHP vulnerability was not exploited on our systems.
Are customer systems affected?
No. We have reviewed our PHP-based systems and taken the necessary measures. Most of these systems were already up to date. For systems running older PHP versions, we have installed the required security updates and put additional protective measures in place. Platforms, portals and databases accessed via VPN (e.g. through the VOB Client or ODBC access) are likewise not affected. The DWT SCADA Client, which we developed ourselves, does not use PHP and is therefore not affected by the vulnerability described.
Do customers need to take any action?
No, no additional measures are currently required on the customer side as a result of this PHP vulnerability. You can continue to use the DWT SCADA Client as usual. Likewise, accessing our systems via VPN or ODBC requires no additional steps in connection with this vulnerability.
What have we done?
We have reviewed the affected PHP versions and our systems, installed available security updates and implemented the required countermeasures. We are monitoring further developments regarding the vulnerability and will assess whether additional measures are necessary if needed.
