MSP Cybersecurity: Whose Job Is the Client’s Website?

The episode exposes a governance gap in risk management and asset responsibility for internet-facing systems—especially websites—within managed service agreements. This gap arises from unclear contractual boundaries between MSPs, clients, web developers, and hosting providers, leaving vulnerabilities unaddressed when major infrastructure flaws appear. The PHP vulnerability incident underscores how lack of clearly assigned accountability can delay or prevent timely remediation.

Two severe flaws in PHP, present since version 5 and with a severity of 9.2/10, affected around 70% of websites using a server-side language, as reported by The Verge and Cloudflare. Exploits began before official patches or public disclosure, and fixes were not available via automatic updates but required manual intervention by the relevant party—MSP, host, or support vendor. Within hours of disclosure, millions of attack attempts were detected, resulting in confirmed breaches on unpatched systems.

Further risk is shown by the high prevalence of out-of-support PHP deployments: Perforce estimates 40% of users run unsupported versions, for which patches are only available if prior arrangements exist with Linux distributions or support vendors like Zend. Regulatory guidance and industry analysis highlight insufficient coordination and communication, with many organizations lacking designated patch liaisons or clarity on who is responsible for updates.

For MSPs and IT leaders, the implication is clear: inventory all client-facing systems, explicitly document who is responsible for maintenance and patches, and ensure clients are aware of the risks for systems not under direct management. Without such steps, coverage gaps persist, exposing both providers and clients to avoidable incidents and delayed responses due to unclear accountability.

00:00 The Day Websites Went Dark 

03:24 The Patch Was Never the Scarce Part

05:37 The Website Outside the Contract

08:17 Why Do We Care?

 

Supported by: 

OpenText 

WebPros(CometBackup) 

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

💼 All Our Sponsors

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.

🚀 Join Business of Tech Plus