Springer Nature is aware of the threat posed by the PHP2Shell vulnerabilities and has responded swiftly and decisively since the threat became known at noon UTC on 21 October.
Please note that our main product and content acquisition platforms do not run PHP and are not affected by PHP2Shell.
The internet traffic of our main product and content acquisition platforms is protected by a Web Application Firewall and monitored 24/7 by a dedicated Web Application SOC team.
The infrastructure and network on which our products and services are running is protected by comprehensive and robust industry-standard security controls and monitored by a 24/7 SOC team.
We have a rigorous, risk-based Unified Vulnerability Management programme in place that identifies exposures and applies patches and secure configurations in our entire estate, whether they are PHP2Shell-related or otherwise.
Several of our minor platforms were using affected versions of PHP. We applied PHP2Shell-related required patches swiftly and comprehensively on the entire digital estate. In cases where the required patches could not be applied, the systems were decommissioned.
There has been no PHP2Shell-related downtime or outage of our main products and services, nor is this expected, and we have found no PHP2Shell-related Indicators of Compromise.