Last week, we shared how we handled the PHP security incident and why we decided to temporarily take our customers' websites offline. Today, I want to share what our investigation found, and recognise the people behind the response.
What we found
Our investigation is complete. In the evidence we examined, we found no sign of a successful intrusion linked to this vulnerability, and no indication that personal data was accessed.
We did find one attack attempt that took place before the patch was in place. Our analysis indicates that it did not succeed.
How we investigated
The investigation covered more than 750 website environments. Our team:
- examined traffic logs, server activity and files,
- scanned for malware,
- compared our records against known attack indicators, and
- looked back several months wherever records were available.
The conclusions were then checked in a separate review.
No investigation can offer absolute certainty. Monitoring continues, and we will inform customers if any new information affects them.
A collective effort
This response was the work of many people and partners.
Aikido Security, our cybersecurity partner, gave us early warnings and access to the most advanced security tools. Having Aikido integrated into our platform is like having a security team that no hosting company could build internally.
Fastly provided the edge protection and detailed logs that helped us both defend and investigate. Our team added protective rules at the edge, but at a certain point it became clear that this would not be enough. That is why we decided to take sites offline.
Niels Aers, our CPO, and Dieter Blomme, our Technical Director, made the early call to protect our customers and took responsibility when the decision was difficult.
Laurence De Medts, our Operations Manager, who has been with Dropsolid for 12 years, was a strong presence behind the scenes, keeping our customers informed and connected when it mattered most.
And everyone else on the team patched, tested, investigated and kept our customers up to date.
Why responsibility matters as much as technology
During an incident, customers should not have to coordinate an agency, a hosting company and a security investigation themselves. They deserve a partner with the authority to act and the responsibility to follow through.
At Dropsolid, we bring together application expertise, our own platform and specialist security partners. That allowed us to defend proactively, investigate afterwards, and give our customers one accountable team throughout. This is what enterprise responsibility means: acting quickly, investigating thoroughly and being open about the findings.
To our customers
We know the downtime had an impact on you and your visitors. Thank you for your patience and trust. You deserved a thorough follow-up, and sharing these findings is part of that commitment.
If your websites are hosted elsewhere, we're happy to show you what this looks like on the Dropsolid Platform: Get in touch