DSA Media News and Information
Further security updates
On Thursday we discovered that a site on our server had been the target of numerous DoS attacks and this has been the cause of the recent downtime issues. Upon discovering this we blocked a large number of IP ranges from the site in question to reduce the impact on this site and subsequently on the server. Our engineers also advised the following urgent actions to be taken:
- Upgrade PHP to the latest version (5.3.8)
- Install Suhosin to secure PHP further
- Disable the ability to run certain (rarely used) PHP functions that could potentially cause a security risk (for a full list of disabled functions please contact us)
- Disable displaying PHP errors on-screen, which should not be used in a production environment. All fatal errors and warnings are still logged to the error_log file in the file’s directory location.
Whilst we have seen a couple of minor issues arise from these updates, which have been dealt with as quickly as possible, most sites are still running as normal and are unaffected.
The main issue that we have seen is due to old or badly coded scripts causing numerous errors. These scripts should be removed from the server or updated immediately as per points 4(a) and (b) on our hosting terms (please note, both are excerpts of the full points):
Clients are solely responsible for ensuring that all scripts installed by them (including any available within your account control panel) are patched and kept up to date.
Any client not keeping their scripts up-to-date and secure is liable to have their site suspended with immediate effect in order to protect the integrity of the server and other accounts hosted on it.
If you find an issue on your site then please first check the relevant error_log file and your Error Log in cPanel, to ensure that it’s not a simple script issue. For any off the shelf scripts, a search on the error will often give you further information with regards to this.
If you do find an unexplainable issue with your site or an issue that you cannot fix then please do not hesitate to contact us, providing as much information as possible including any search results or further information you have found online.
Please be aware that if we have to take time to support and/or fix an out-of-date or unsecure script then we may have to charge for this at our hourly rate of £40 + VAT (this does not include issues that have arisen from adding Suhosin, Mod Security or disabling certain PHP functions).
