PHP2SHELL Security Alerts - MySchool's Action Report

MySchool is fully patched against PHP2Shell, and we have found no sign that your account or data was affected.

On 20 and 21 October 2026, the PHP project disclosed two critical vulnerabilities in PHP, the language that runs MySchool's application and a large share of the internet. We put protective measures in place immediately and installed the official fixes as soon as they were released. You do not need to take any action.
 

The PHP project found two flaws, known together as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), that could let an attacker run code on a web server without logging in. Both are rated critical, 9.2 out of 10.

The flaws were in PHP's core engine, not in any company's own code. That means they affected a huge range of websites and apps across the internet, not just ours. Details also leaked online a few hours before the official fix was released, which is why the whole industry treated this as urgent.

The PHP project released fixed versions (8.2.35, 8.3.36, 8.4.27 and 8.5.12) on 21 October 2026, along with fixes for older versions.
 

We received the PHP project's official advance security notice on 20 October, the day before the details were published, and our security team began preparing straight away.

We monitor official security announcements for all the software we rely on. When the full details and fixes arrived on 21 October, we were ready to act on them immediately.
 

We protected systems in two stages: first by changing configuration to close the known attack routes, then by installing the official fixes once they were available.

As soon as we had the details, we applied the protective settings recommended by the PHP project and security researchers, closing the known routes of attack. When the official patches were released, we installed them across all our systems and restarted every PHP service so the fixed versions were in use straight away.

We tested MySchool against publicly available proof-of-concept attack code in a controlled environment twice: first with our initial protective measures in place, and again after installing the official patches. In both cases the attack was blocked and did not succeed.
 

On 23 October, PHP announced a separate, lower-risk issue (CVE-2026-115560). MySchool is not affected by it.
 

We found no evidence that these vulnerabilities were used against any of our systems.

Our security monitoring watches traffic and server logs around the clock. During this incident we also looked specifically for the signs security researchers have published for PHP2Shell attacks. We found no suspicious traffic, unexpected crashes or other signs of compromise.

We will keep watching closely over the coming weeks, and we will contact you directly if anything changes.
 

This is exactly the kind of event our security processes exist for, and each step ran as planned.

We are certified to ISO/IEC 27001, the international standard for information security management. It requires us to keep a full inventory of our systems, watch for new vulnerabilities, assess them quickly and fix them on a defined timeline. That inventory meant we knew straight away which systems needed attention.
 

You don't need to do anything. MySchool runs on our servers, so every fix was applied on our side.

There is no app update to install and no settings to change.