Today a lot of teams are scrambling to patch systems affected by the latest PHP vulnerability, and our sympathies go out to everyone working through it.
Several of our customers have reached out to ask whether their Syncplify software is exposed. The short answer: it is not. None of our products use PHP, so there is nothing to patch on our side.
This isn’t luck, and it isn’t the first time. Since Syncplify was founded almost 13 years ago, one of our guiding principles has been to keep external dependencies to a bare minimum (ideally zero). Every dependency is code we didn’t write, can’t fully audit, and have to trust.
That principle has served our customers well before. When Heartbleed hit OpenSSL in 2014, Syncplify software was not affected. When the Terrapin attack targeted SSH/SFTP servers in 2023, again, our customers were not affected.
No software is immune to bugs, including ours of course, and we’ll keep treating security as a first-class citizen and a never-ending task. But fewer dependencies means a smaller attack surface, and that is the guarantee our philosophy gifts to all our customers.
If you’re spending this week patching other systems, we hope it helps to know your SFTP server is one item you can already cross off your to-do list.