PHP2Shell: a critical flaw in PHP, the language the site is written in
- Found
- 22 October 2026
- Resolved
- 22 October 2026, 2:45 pm
- CVE numbers
- CVE-2026-109618, CVE-2026-109619
- Severity
- Critical (CVSS 9.2): being exploited around the world
- Personal information exposed
- None found
What happened
PHP is the programming language that runs this site (and about three quarters of the websites on the internet). On 21 October 2026 two flaws in PHP itself were found being used in attacks around the world. Together they let an attacker send a specially made request to a website and run their own code on its server: before the site's own code (and its sign-in) even starts.
The PHP team released a fix that day. The version of PHP our server used didn't have a fixed package yet, so we couldn't simply update straight away.
What it could have meant
If it had been used against us, an attacker could have taken control of the web server, and from there tried to reach the database. That's why it was rated critical.
What we did
| When (NZ time) | What we did |
|---|---|
| 22 Oct, morning | The Director heard about the flaw and asked for both of our servers to be checked. |
| 22 Oct, 10:00 | Every attack known used one kind of request (a file upload). We changed the web server to refuse that kind of request before it reached PHP, and tested the change on our test copy of the site. |
| 22 Oct, 10:28 | The block was live on the real site. The cost: uploading files (such as a school's logo) was switched off for a few hours. |
| 22 Oct, 11:00 | We checked the site's records from before the block for any sign of an attack: errors, crashes, unusual requests. We found none. |
| 22 Oct, 11:25 | While checking, we found and fixed an unrelated fault: some made-up web addresses (tried by an automatic scanner) gave an error instead of going to the home page. |
| 22 Oct, 12:38 | Amazon advised blocking one more kind of request as a precaution. We did that too. |
| 22 Oct, 14:20 | Amazon released the fixed version of PHP for our servers. We installed it. |
| 22 Oct, 14:45 | With the fix installed, we removed the block, so uploads work again. Closed. |
Was anyone's information exposed?
We found no sign that anyone tried this attack on our site, and no sign that anyone's information was seen or changed. We can't prove a negative, but the records we checked would normally show the crashes this attack causes, and they showed none. No school, teacher or student needed to be told, because no personal information was affected.
What we learnt
- We heard about the flaw from the news, not from an automatic alert. We're setting up alerts for security fixes to the software our site runs on.
- Our "down for maintenance" page is itself written in PHP, so it couldn't protect us from a flaw in PHP. We're adding a way to close the site that doesn't depend on PHP.
- Keeping good records (logs) let us check for an attack in minutes. We're adding a little more detail to them.
This is a summary for schools and students. It leaves out details that could help someone attack the site. Our full internal record is kept for audits.