Iress is aware of two critical vulnerabilities in PHP, one of the key technologies used to enable information delivery on a vast majority of websites globally, which could allow attackers to gain remote access to website servers.
As soon as we became aware of the potential issue, our Information Security team commenced a thorough investigation of Iress’ technology assets and immediately applied the patches provided by PHP to protect against any threats, implemented additional detections in our security monitoring tools to alert any attempts to exploit the vulnerabilities as we systematically patch the environment, and leveraged our 3rd and 4th party provider security assurance processes to assess and limit any downstream impact through our technology supply chain.
At this stage, we do not believe the vulnerabilities impact our core platforms - including Xplan and IOS - where PHP is used in a limited capacity. There have been no security breaches or unauthorised access to customer data identified as a result of the vulnerability.
The Financial Knowledge Centre and Iress Learning Centre, which are hosted on third party systems, were both identified as being potentially vulnerable. Access was temporarily removed, with security updates successfully applied on October 22. Both sites are now online with no breaches or open vulnerabilities detected.
We will continue to investigate the situation and provide further updates to clients as required.
No action is required from clients at this time.
For further information, please monitor updates on this Iress Community page.
