@scrchngwsl it is a bit scary, but for sites like Givenergy, I would assume they run behind the tech curve, so there’s every chance they’re still running a safe and secure version like 8.3 or 8.4. That said, you never know, and the world’s websites are dependent on PHP. We always run a version behind here on RHH for stability and plug-in compatibility more than anything else, but we’ll now add security to our update decisions. 

Posted by: @scrchngwsl

↑

Another angle to this is how vulnerable it leaves you to hackers.

I have a GivEnergy battery. The company, somewhat infamously, is now defunct. Their inverters, however, still phone home to GivEnergy's servers.

Those servers run PHP. PHP has a massive security flaw that essentially allows hackers to do whatever they want with the server. The fix has been released, but it requires server admins to apply the patch manually. It's not clear if whoever still operates GivEnergy's cloud servers will do that.

Consequently, a lot of consumers will now have inverters who are connected to a cloud that could have been hacked. Since those servers control the inverter's firmware/software updates, the hackers could force upload malicious software to your inverter at home.

The mitigation from an end user perspective is to change your router settings to block the inverter from connecting to the internet. You can still allow it to connect to your wifi, and thus be controlled locally, but not remotely via the cloud.

However, most users will not know anything about this. They won't know about the vulnerability in PHP. They won't know that GivEnergy's servers are affected and might be compromised indefinitely. They won't know that their inverters contact those servers and may be affected too. They won't know if their inverters have had malicious code uploaded to them by GivEnergy's servers. And they won't know how to change their router settings to block their inverter from connecting to the internet.

It's pretty scary tbh.

There is plenty of truth in this, @scrchngwsl, but it needs to also be tempered in a couple of areas.

The simple fact is that it is very difficult to find a commercial API that doesn't at times exchange what is known under GDPR as personally identifiable information. Any organisation that in some way handles or processes personally identifiable information has to do so in accordance with GDPR and the penalties are severe.

In the case of GivEnergy, those cloud servers may well now be run by someone else but if they are hacked and personal information is compromised then that someone else is liable. It doesn't matter whether they have commercial reasons for providing the service or if the service is being kept running by the goodness of their hearts. As a result, I can't say the GivEnergy cloud servers ARE being patched, but if they're not then the new owners of those servers are risking their business by not doing so. Given the new owners are a different arm of the GivEnergy group, I would therefore bet real money that they are at least trying to get the servers fixed. I would therefore certainly challenge the idea that the servers might be compromised "indefinitely".

Everything else you say about the risks of using cloud based services, about mitigations and about how much consumers typically realise is still valid, though. It's still scary, but we also shouldn't start jumping at shadows.

@editor I think that you're being a bit optimistic. From my brief investigation (I have a couple of trivial websites) I found this.

"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately."

Which strongly implies that earlier versions are vulnerable. I wouldn't expect a nearly defunct company to be keeping up to date with patches.