Our Response to Internet-Wide Website Security Issues

In response to the discovery of two major security issues affecting many websites across the internet, several of the Inn’s digital services were taken offline for a short period yesterday out of an abundance of caution, in line with UK Government guidance.

The cause was a set of security vulnerabilities announced yesterday in PHP, which underpins the software that runs the Inn’s website and many similar systems across the web. The Inn’s main website, which processes user data and takes payments, was hardened with the recommended mitigations put in place upon early reports of the security disclosure, and patches were applied promptly on release by the PHP Foundation with no downtime. Online services provided by external vendors covering admissions, our online learning platform and our mentoring schemes were all taken down so our vendors could apply fixes. All affected services have now been patched and are running normally.

To reassure you, we have no indication that any member data was accessed or affected. PHP is software that runs on our servers and those of our suppliers. It is not installed on your own computer, phone or tablet, so there is nothing for you to download, install or change, and you do not need to take any action.

Please also be alert to scam messages that sometimes follow news of this kind. The Inn will never email or telephone you to ask for your password, so please disregard and report any message that does. Because these issues affect many websites beyond the Inn’s own, it’s sensible to be a little more careful than usual online over the coming weeks. If a site behaves oddly, asks you to sign in several times over, or simply looks different from how you remember it, please do not enter your details, and close the page.

If you would like to discuss this issue or the Inn’s response to it, please contact Paul Clark.