Vendor Security Is Your Security (EP 1092)

I don’t do websites, so my first reaction to the PHP security headlines was that this probably wasn’t my problem. Then clients started asking what they needed to worry about, and I had to give them an honest answer: I didn’t know yet, but I would find out. This solo conversation follows the questions that sent me digging into vendor notices, client systems, and the applications connected to their Microsoft 365 environments.

Between the PHP concerns and the ConnectWise cloud backup incident discussed on the show, the bigger lesson became clear: vendor security is our security. I share what I’m reviewing, where I found gaps in my own processes, and why we can outsource services without outsourcing our responsibility to understand the risks our clients are accepting.

=== Chapters

00:10 MSP Vendor Security and Client Responsibility
00:22 PHP Vulnerabilities: Beyond Website Security
01:38 ConnectWise Cloud Backup and Microsoft 365 Risks
03:19 Action1 and Vendor Security Communications
07:34 IT Asset Inventory and Patch Ownership
09:55 Patch Verification and Signs of Compromise
12:35 Microsoft 365 App Permissions and Vendor Access
16:07 Backup Restore Testing and Vendor Outages
18:05 Client Communication and Cybersecurity Accountability

=== Resources / Books / Podcasts / Apps

• PHP2Shell: Official PHP vulnerability announcements and security updates. https://www.php.net/archive/2026.php
• Action1 service pause: Official statement about temporarily suspending services as a security precaution. https://x.com/Action1corp/status/2112958795240374585
• Action1 service restoration: Vendor announcement and follow-up confirming patching and restored services. https://community.spiceworks.com/t/action1-service-temporarily-paused-as-a-security-precaution/1258964
• Action1 PHP2Shell guidance: Finding PHP risks beyond websites. https://www.action1.com/blog/php2shell-the-biggest-risk-is-the-php-you-dont-know-youre-running/
• ConnectWise Cloud Backup: Official incident updates and guidance for the separate Cloud Backup security incident. https://www.connectwise.com/company/trust/advisories

=== SPONSORS:

• Technology Partner, NetAlly: https://www.itbusinesspodcast.com/netally/
• Technology Partner: Bvoip: https://www.itbusinesspodcast.com/bvoip
• Travel Partner: TruGrid: https://www.itbusinesspodcast.com/trugrid
• Digital Partner, Designer Ready: http://itbusinesspodcast.com/designerready

=== SHOW MUSIC:

• Item Title: Upbeat & Fun Sports Rock Logo
• Item URL: https://elements.envato.com/upbeat-fun-sports-rock-logo-CSR3UET
• Author Username: AlexanderRufire
• Item License Code: 7X9F52DNML

=== Connect with Uncle Marv

🌐 Website: https://www.itbusinesspodcast.com/
🎙 Host: Marvin Bee
🛒 Uncle Marv’s Amazon Store (gear & tools I recommend): https://amzn.to/3EiyKoZ
☕ Support the show: https://ko-fi.com/itbusinesspodcast

If you found value in this episode, share it with another MSP, IT provider, or tech entrepreneur. Your support helps keep practical, no-nonsense IT business conversations coming every week.