MSP Cybersecurity: Whose Job Is the Client’s Website?

The episode exposes a governance gap in risk management and asset responsibility for internet-facing systems—especially websites—within managed service agreements. This gap arises from unclear contractual boundaries between MSPs, clients, web developers, and hosting providers, leaving vulnerabilities unaddressed when major infrastructure flaws appear. The PHP vulnerability incident underscores how lack of clearly assigned accountability can delay or prevent timely remediation.

Two severe flaws in PHP, present since version 5 and with a severity of 9.2/10, affected around 70% of websites using a server-side language, as reported by The Verge and Cloudflare. Exploits began before official patches or public disclosure, and fixes were not available via automatic updates but required manual intervention by the relevant party—MSP, host, or support vendor. Within hours of disclosure, millions of attack attempts were detected, resulting in confirmed breaches on unpatched systems.

Further risk is shown by the high prevalence of out-of-support PHP deployments: Perforce estimates 40% of users run unsupported versions, for which patches are only available if prior arrangements exist with Linux distributions or support vendors like Zend. Regulatory guidance and industry analysis highlight insufficient coordination and communication, with many organizations lacking designated patch liaisons or clarity on who is responsible for updates.

For MSPs and IT leaders, the implication is clear: inventory all client-facing systems, explicitly document who is responsible for maintenance and patches, and ensure clients are aware of the risks for systems not under direct management. Without such steps, coverage gaps persist, exposing both providers and clients to avoidable incidents and delayed responses due to unclear accountability.

00:00 The Day Websites Went Dark
03:24 The Patch Was Never the Scarce Part
05:37 The Website Outside the Contract
08:17 Why Do We Care?

Supported by:
OpenText https://cybersecurity.opentext.com/
WebPros(CometBackup) https://cometbackup.com/?utm_source=mspradio&utm_medium=podcast&utm_campaign=sponsorship

💼 All Our Sponsors

ABC Solutions — https://go.businessof.tech/p/abc-solutions-yt
CometBackup — https://go.businessof.tech/p/cometbackup-yt
FireTail — https://go.businessof.tech/p/firetail-yt
Guardz — https://go.businessof.tech/p/guardz-yt
HaloPSA — https://go.businessof.tech/p/halopsa-yt
LogMeIn — https://go.businessof.tech/p/logmein-yt
Mailprotector — https://go.businessof.tech/p/mailprotector-yt
OpenText — https://go.businessof.tech/p/opentext-yt
Oveka — https://go.businessof.tech/p/oveka-yt
Pax8 — https://go.businessof.tech/p/pax8-yt
Rythmz — https://go.businessof.tech/p/rythmz-yt
ScalePad — https://go.businessof.tech/p/scalepad-yt
TimeZest — https://go.businessof.tech/p/timezest-yt

Supporting the IT services community through insights, analysis, and transparency.

⸻

🚀 Join The Small Biz Thoughts Community

The membership for independent MSP owners: vendor intelligence, member-only briefings, a private peer forum, and direct access to Dave.

👉 https://smallbizthoughts.org/join/

⸻

🎧 Subscribe to the Business of Tech

Want the show on your favorite podcast app or prefer the written versions of each story?
📲 https://www.businessof.tech/subscribe

⸻

📰 Story Links & Sources

Looking for the links from today’s stories?
Every episode script — with full source links — is posted at:
🌐 https://www.businessof.tech

⸻

🎙 Want to Be a Guest?

Pitch your story or appear on Business of Tech: Daily 10-Minute IT Services Insights:
💬 https://www.podmatch.com/hostdetailpreview/businessoftech

⸻

🔗 Follow Business of Tech

LinkedIn: https://www.linkedin.com/company/28908079
YouTube: https://youtube.com/mspradio
Bluesky: https://bsky.app/profile/businessof.tech
Instagram: https://www.instagram.com/mspradio
TikTok: https://www.tiktok.com/@businessoftech
Facebook: https://www.facebook.com/mspradionews