On October 21, PHP shipped emergency fixes for two critical security flaws. PHP is the programming language behind a large share of the web and many home-grown research databases. Attacks began before a fix existed, and CISA urged everyone to update right away.
If your trial data lives on a system your team built, the question isn’t whether you saw the news. It’s who on your team handled it, and how fast.
Software is never finished
Building a trial database in-house feels like a one-time project. The real cost comes after launch. A database depends on a programming language, a web server, a database engine, an operating system and dozens of libraries. Each one ships updates on its own schedule, and eventually stops getting them.
That creates work that rarely appears in a grant budget:
- Security patches. Critical fixes can arrive any week, and some can’t wait.
- Forced upgrades. When a language reaches end of life, working code has to be rewritten.
- Backups. Someone has to confirm years of multi-site data can actually be restored.
- Turnover. The grad student who built the system moves on, and the know-how leaves with them.
So the person hired to evaluate varieties ends up troubleshooting servers instead. Meanwhile the field data waits and reports slip.
What this week asked of a home-grown system
The PHP flaw let outsiders break into affected servers without a password. It had nothing to do with how well anyone’s own system was built. Older PHP versions got no fix at all.
If you run your own system, check these this week:
- Find your PHP version. Your server’s host or IT office can tell you.
- Install the patched release listed in PHP’s advisory. If your version is too old to get a fix, plan an upgrade now.
- Look for signs of a break-in: unfamiliar files, unexpected logins or changed data.
Next month, it will be something else.
“But AI can write the code for us”
With AI tools, a researcher can build a working data entry app in an afternoon. But writing the code was never the hard part. Keeping it running and secure is.
An AI can generate a system, but it won’t own it. It won’t notice the headline, check your server’s PHP version, or answer for your data if someone gets in. And code nobody on your team fully understands is even harder to fix.
What Medius did this week
We saw the bulletin the day it came out. That same day, we applied the officially recommended workaround to our servers. The next morning, we installed the patched PHP release and confirmed no one had gotten in.
All of it happened during the Potatoes USA National Fry Processor Trial (NFPT) evaluation in East Grand Forks. None of the participants noticed.
That’s the partnership. Keeping Medius.Re patched, monitored and available is our job, not yours. You still get a system shaped around your trials, crops and criteria:
- We watch security advisories and act on them fast, so you never have to learn what a CVE is.
- Standardized fields keep yield data out of the irrigation column, and partners across institutions work from one dataset.
- Secure hosting on Amazon Web Services, available from the office, a tablet or a phone in the field.
See Why Medius for the rest.
Do research, not server maintenance
This week’s flaw will be patched and forgotten within weeks, and another will take its place. The question is whether your team or a dedicated partner answers the call.
You were hired to do research, not to babysit servers. Talk with our team about moving your trial data to Medius.Re.