When two critical PHP remote code execution flaws were disclosed, a multi-hospital health system in the Midwest needed to know where it was exposed. Its security team asked ORDR IQ and got an executive brief back almost immediately: 21 affected devices, 5 high-risk, across 2 sites. That answer was possible because the team had already connected the software inventory data that tells ORDR what is installed on each device.
The Challenge
Two unauthenticated remote code execution vulnerabilities in PHP were disclosed together, each with a CVSS 4.0 score of 9.2. Both can be exploited over the network with no login. One could only be fixed by patching; the other had only a partial mitigation.
PHP runs quietly inside web servers, management consoles and vendor applications. It rarely shows up in an asset list, and the people who manage those systems often don’t know which version is installed. Leadership asked the questions every security team hears on day one of a zero-day: Are we affected? Where? How bad is it?
Answering usually means scanning, emailing system owners and assembling a spreadsheet by hand. For a small team in a hospital environment, that can take days.
The Solution
The health system had already done the groundwork. Alongside network traffic, ORDR was receiving installed-application data from the ORDR Software Inventory Collector (OSIC) and the team’s endpoint security tools. That meant ORDR knew which devices ran PHP and which version, not just which devices existed.
When the vulnerabilities were disclosed, the team asked ORDR IQ about its exposure in plain language. ORDR IQ pulled together the affected devices, their risk scores, locations and PHP versions, and produced a ready-to-share executive brief. The brief included a clear call to action, charts of risk and device type, a plain-language summary of each vulnerability, and a prioritized list of the riskiest devices.
ORDR IQ also looked beyond PHP. It flagged the health system’s Palo Alto Networks firewalls, whose software versions weren’t yet captured in ORDR, as needing validation against separate known CVEs.
The Results
What the brief showed | Result |
Devices running affected PHP versions | 21, across servers and workstations |
High-risk devices (risk score 7 or higher) | 5, ranked for remediation first |
Sites affected | 2 |
End-of-life PHP versions found | On several high-priority servers |
Firewalls flagged for version validation | 19 |
Instead of days of scanning and emails, the security team had a scoped, prioritized answer to bring to leadership on day one. It knew which five devices to fix first, which sites to call and which systems were running PHP versions too old to patch at all.
Why It Worked: Connect Your Software Inventory
ORDR IQ can only answer with the data ORDR has. Other organizations asked the same PHP question and couldn’t get an answer, because installed-application data wasn’t flowing into ORDR. Without it, ORDR can see that a server exists but not what software it runs.
Servers are where this gap shows up most. Many organizations have limited endpoint security coverage on servers, which is exactly where PHP lives. The lesson for any ORDR customer:
- Turn on the ORDR Software Inventory Collector for Windows, Linux and macOS servers and workstations. It runs as a scheduled task and needs no agent.
- Connect your endpoint security and device management tools so installed apps, versions and patch levels reach ORDR.
- Ask ORDR IQ before you need it. Try a question like “Which devices run PHP, and which versions?” now, so you know the data is there when the next zero-day lands.
About ORDR
ORDR believes healthcare teams should be able to focus on caring for patients, confident that the connected technology they depend on is secure.
ORDR makes that possible by turning device intelligence into action, helping healthcare organizations address cyber risk before it disrupts care. It combines deep device understanding with segmentation that is tested before it’s enforced, using the network and security tools hospitals already own.
ORDR’s AI-powered connected device security platform discovers devices without agents, including medical devices, identifies risk, and automates segmentation and enforcement. With ORDR IQ, teams ask questions of their own data in plain language and turn the answers into reports and dashboards.
Trusted by leading healthcare organizations across the United States, ORDR secures more than 100 million devices.
Learn more or request a demo at www.ordr.net.