PHP2Shell for Schools, Colleges and Districts

As of 23 October 2026, the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, exploitation attempts are widely reported, and no confirmed successful break-in has been publicly documented. For a school district or college, the job is to find every system that runs PHP, get each one patched and restarted, and get written answers from the vendors who host the rest.

That list is usually longer than people expect. A self-hosted Moodle site, the district or college website, individual school or department sites, and tools a teacher or lab set up on their own server can all run PHP. CISA warned on 21 October 2026 that "PHP is often a component of other software and prevalence may not be directly observable."

This guide is for district IT staff, college IT and web teams, and the administrators who have to decide what to take offline. It covers what PHP2Shell means for education specifically. Every school system is different, so treat the lists below as a starting point.

Why Schools Are a Likely Target

CISA says that "for K-12 schools, cyber incidents are so prevalent that, on average, there is more than one incident per school day" (CISA K-12 cybersecurity). Schools and colleges hold data attackers want, often with small IT teams spread across many buildings and departments.

PHP2Shell adds two education-specific pressures. First, systems are scattered: a district office may run the main site while schools, clubs, libraries and departments run their own. Second, timing. Taking a learning platform offline during exams or grading hits students directly, so the decision needs someone with authority, not just IT.

Step One: Find Every PHP System

Build the list before you patch, or you will patch the ones you know about and miss the rest. ENISA's joint statement gives the order: "identify their PHP-based applications, coordinate with hosting and service providers, and apply the released security updates. Prioritise internet-facing systems."

A server that hosts many school or department sites runs them all on one PHP installation. One update protects all of them, and one missed server exposes all of them. On each server, check the PHP that serves web pages, not just the command line. Our guide on how to check your PHP version explains why they can differ.

Moodle: What Moodle HQ Has Said

Moodle HQ posted an update on 22 October 2026. It says that "as a precautionary measure ... Moodle HQ made the decision to take our sites offline," then patched and restored them, and is "continuing to deploy and validate the patches on our other public facing and client sites." Its message to schools that host Moodle themselves: "We strongly encourage self-hosted site holders to notify the individual(s) responsible for updating PHP for their sites ... Unpatched sites remain vulnerable." Read the post on moodle.org.

If your Moodle is hosted by Moodle HQ or a partner, ask them to confirm your site is patched. Moodle HQ's post refers to "client sites" and does not name a specific service, so don't assume.

Check which PHP your Moodle release can run. These are the minimums from Moodle's developer release notes:

Moodle shows the PHP details under Site administration > Server > PHP info. Remember that a patched Linux package can keep an old version number. The Dutch NCSC's software inventory also flags Moodle's Windows and Mac "complete installer" packages, which ship their own PHP. If a staff member installed Moodle that way for a class, that copy needs attention too. Our Moodle and PHP2Shell guide has the full detail.

School Websites on WordPress, Drupal or Joomla

The flaw is in PHP, not in WordPress, Drupal or Joomla, and no CMS update fixes it. WordPress.org said on 21 October 2026 that "No WordPress update is required or planned." If your district's sites run WordPress, our WordPress and PHP2Shell guide covers the steps. Site editors in communications offices don't need to change anything in the dashboard. The work happens at the server or the host.

Questions to Ask Your Education Vendors

Much of a district's or college's software is hosted by vendors. Send each vendor that runs a web-facing system these questions and keep the answers on file:

1. Does any part of your service, including admin portals, run on PHP?
2. If so, which fixed PHP build is in production, and when were PHP workers restarted?
3. Have you found any sign of exploitation since 17 October 2026, the earliest reported attempt?
4. Could any data you hold for us have been exposed, and how and when would you notify us?
5. Is session upload progress switched off, as PHP advised on 23 October 2026 for a related issue (CVE-2026-115560)?

Some hosts state their position publicly. Pantheon, for example, says "customers are responsible for designing their application correctly to meet FERPA standards," while its own policies "allow customers to be FERPA compliant." That split is typical. The platform covers its servers; your institution is responsible for what runs on them. Our shared responsibility guide explains how to divide those duties. Texas public institutions may also check a vendor's TX-RAMP status. Pantheon lists Level 1 and WordPress VIP lists Level 2.

FERPA Basics if Student Data May Be Involved

FERPA is "a federal law that affords parents the right to have access to their children's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records." The rights move to the student at 18 or on entering postsecondary education. The statute is 20 U.S.C. § 1232g and the regulations are 34 CFR Part 99. See the Department of Education's FERPA overview.

Why this matters for PHP2Shell: one path can leak server memory, which Wiz says "may contain passwords, authentication tokens, API keys and certificates." If a server that handles student records was unpatched and shows signs of compromise, treat the records as possibly exposed. Bring in your counsel early. State student-privacy and breach notification laws may also apply. This is general information, not legal advice.

Taking Systems Offline Without Chaos

CISA's 21 October alert says organizations "that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated." Moodle HQ showed it can be done briefly and in the open. For schools:

• Decide in advance who can approve taking a learning platform or portal offline.
• Tell faculty and students first, with an expected return time and an alternative for deadlines.
• Use a maintenance page or a network block. Beazley Security warns against disabling the PHP handler, "which can expose application source code and credentials."
• If you can't patch today, our interim mitigations guide lists the official stopgap settings. None of them replaces the update.

Free Help, Funding and Reporting

• CISA Cyber Hygiene: free vulnerability and web application scanning for state, local, tribal and territorial governments and critical infrastructure organizations. Check whether your district or institution is eligible on CISA's Cyber Hygiene page.
• CISA's K-12 recommendations: its January 2023 report puts deploying multifactor authentication, mitigating known exploited vulnerabilities, and implementing and testing backups at the top of its list.
• FCC Schools and Libraries Cybersecurity Pilot: a three-year pilot of "up to $200 million." Its application window ran "March 18 – September 15, 2025," and a Federal Register notice in August 2026 showed it still running. It is not a source of new emergency money. See USAC's pilot page.
• MS-ISAC: membership is now fee-based. Federal support for it ended on 30 September 2025.
• Reporting: CISA asks organizations to report incidents 24/7 to report@cisa.gov or 1-844-Say-CISA. Our incident response plan guide covers the first hour.

Public school districts are also covered in our local government website security guide, including .gov domains and procurement.

Conclusion

For schools and colleges, PHP2Shell is mostly a finding problem. The fix is the same everywhere: a patched PHP build and a restart. The hard part is the Moodle server in a closet, the school site on a forgotten hosting plan, and the vendor portal nobody has asked about. Build the list, patch what you run, get written answers on the rest, and handle student data questions with counsel. If your team needs hands-on help with a server, our emergency PHP patching service can work alongside district or campus IT. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions