Case studies · Security & Networking
Multi-sector
PHP2Shell matters because of where PHP sits: web tiers, appliances, and management interfaces, often installed years ago and maintained by whoever inherited them. A single CVE family can cover a dozen different products across one client's estate, and the answer changes device by device — version, exposure, vendor support. Multiply that across a whole book of clients and the hard question stops being "is this system patched?" and becomes "which clients have a system nobody has answered for yet?" — including the clients whose equipment we don't maintain, who have no service provider asking the question on their behalf.
We worked the client base as a checklist, not a rumour: every client on a maintenance agreement had their full estate — servers, services, and devices — examined against the advisories' affected scope, so each engagement produced a per-system yes/no, in scope or out, with the evidence behind it, before any remediation was scheduled.
Where a vendor update existed, we applied it and moved affected systems to the fixed release.
Where no update existed — vendor fix not yet released, or the platform too far behind to take one — we changed the exposure instead of accepting the risk: the device was reconfigured to stop facing the outside world, protection around it was raised, and it went onto a formal upgrade waiting list.
The response didn't stop at the maintenance boundary. Clients whose equipment we don't maintain received an email reminder about the vulnerability.
Every system we checked came back clean — no evidence of compromise across the audited client base. Each client under maintenance finished the incident with a complete PHP2Shell position: patched where an update existed, or withdrawn from external exposure with stronger protection and an upgrade waiting-list entry. Clients outside the maintenance relationship received an email reminder.
Whether it’s a critical server issue or a long-term digital transformation project, our team is ready to assist. Reach out and experience ITR’s expert support that actually works.
