Two critical security vulnerabilities in PHP are currently making headlines. Operators around the world are having to respond, update systems and, in some cases, implement short-term safeguards.
Reports like these are a reminder that software security does not depend solely on whether a particular vulnerability exists today. What also matters is how software is developed and operated – and how quickly actions are taken when the next vulnerability comes to light.
TSI systems are not affected by the current PHP security vulnerabilities
In-house development, active monitoring and continuous improvement help keep your systems secure.
In-house development. Full control. Short paths.
We develop and operate our solutions ourselves – from the underlying architecture and core services to the applications our customers use every day. We also manage and take responsibility for the day-to-day operation of our systems. This gives us detailed knowledge and control of our systems and our technology stack, while keeping both operations and further development firmly in our own hands.
We do not have to wait for third parties, with requests passing from a reseller to a manufacturer before decisions can be made and updates eventually released.
We work on our systems continuously, improving, updating and optimising them. Anything important or security-critical automatically moves to the front of the queue and is implemented immediately.
Active development and continuous evolution
Our solutions are under active development at all times. New features, enhancements and usability improvements are added to our systems on an ongoing basis. And we mean that quite literally: New software releases reach our customers several times a week and, during intensive development phases, sometimes even several times a day.
Security is an integral part of our development and architecture – not something added as an afterthought. We evaluate new security mechanisms and technical capabilities early and adopt them when they provide a genuine security benefit.
Examples include a strict Content Security Policy (CSP), which works in the background to control what content and code a web application is allowed to execute, as well as hardware-based two-factor authentication using physical security keys. We have been implementing security measures like these, in some cases long before they became widely established standards.
Technical updates, security updates and bug fixes are also a natural part of this continuous work. We do not wait until existing technologies are being phased out or there is an urgent need to act before adopting new security standards. Instead, we incorporate them regularly as part of the normal development of our systems.
Detecting problems is good. Acting on them is better.
Perfect, completely error-free software systems do not exist. Anyone claiming otherwise is selling snake oil. For us, professional software development therefore means dealing with this reality from the outset and building the necessary mechanisms into our systems and workflows.
Our systems provide detailed monitoring, extensive diagnostic capabilities and error logging. This allows us to continuously track the technical health of our applications, identify anomalies early and provide our technical and development teams with the information they need for rapid analysis.
But monitoring alone does not solve problems. An error reliably recorded somewhere in a log file is still a long way from being fixed. That is why we actively review alerts, investigate anomalies and take action directly. Insights from day-to-day operations feed directly back into development and maintenance.
This makes a very practical difference: When an error does occur, our technical or development team is often already working on a fix before the first customer contacts us. Sometimes the problem has even been resolved by the time we receive the first customer report.
Security goes beyond the current PHP headlines
The critical PHP security vulnerabilities currently being discussed do not affect our systems. PHP is not part of our technology stack.
For us, however, this is less a reason for celebration than a timely example of why we place such importance on a modern, actively maintained technology stack that remains under our own control.
Security is an ongoing responsibility. The next vulnerability will come – in one technology or another. What matters is identifying new risks early, assessing them properly and taking decisive action.
Our development, ongoing maintenance and technical processes are designed around exactly that. We continuously assess and prioritise new security risks. If a vulnerability affects us, we immediately start working on the necessary safeguards and updates – with the highest priority.
Technology is only as good as the team behind it
Behind our solutions is an experienced team spanning development, technical operations and support, developing, operating and continuously improving our systems in-house.
These areas do not work in isolation, but directly with one another. Insights from day-to-day operations reach our developers, feedback from support feeds into improvements, and new features reach our customers through short, direct channels.
This is how we see ourselves as a partner to our customers: reliable in day-to-day operations, open to new requirements and working together towards the solutions of tomorrow. That is exactly what we mean when we say: TSI – Your Telematics Partner.
Deutsch