PHP2Shell: what the PHP flaw means for schools

This week, your child's learning platform might have shown a "down for maintenance" page just when an assignment was due. If it did, there's a good chance one bug was behind it.

It's called PHP2Shell, and it's one of the biggest web security stories in years. Here's what happened, why school sites went dark, what it means for your family or your classroom, and what we took from it as a small edtech team.

> Key takeaway: PHP2Shell is a flaw in PHP itself, the software behind a huge share of websites, including many school systems. The fix is out. Schools and their providers need to update PHP, and families mostly need patience, saved work and a little extra caution with emails.

What is PHP2Shell?

PHP2Shell is the nickname for two critical security flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is a programming language that runs on web servers. When you load a page, PHP often builds it before sending it to your browser.

The PHP project's security advisory says both flaws can let an attacker run their own code on a server without logging in. Both are rated 9.2 out of 10 for severity. PHP says every installation that serves web pages is at risk.

The bugs sit deep inside PHP, in how it cleans up memory when a request goes wrong. According to Wiz Research, which reported the flaws, every PHP version back to 5.4 is affected by at least one of them. Wiz also showed attackers could read a server's working memory, which can contain passwords and access keys.

Why this one is such a big deal

PHP is everywhere. The ABC reported that PHP runs about 75% of websites whose programming language can be identified, according to the tracker W3Techs. It's the engine behind WordPress, Drupal and Joomla, and behind Moodle, the learning platform many schools and universities use.

Because the flaw is in PHP rather than in any one website, a site can be well built and still be exposed. Wiz says even a simple "Hello World" page on an affected PHP version can be attacked.

How AI helped find it

Here's the part that caught our eye. The flaws were found with the help of frontier AI models. OpenAI says the security firm Calif found a critical flaw using its model, and Wiz independently found and reported both flaws using AI tools of its own.

According to Calif, as reported by SecurityWeek, an early version of the memory problem was first spotted in 2020. It wasn't fixed then, because nobody could prove it was exploitable.

AI made that proof practical. Wiz says a single researcher with these tools did in a week what would once have taken a top team months.

The flow-on effects: why school sites went offline

The fix was due on 21 October, but details leaked the day before. That meant attackers could start probing before patches existed. So many organisations chose to switch sites off rather than risk it.

• Learning platforms paused. Moodle HQ took its own public sites offline as a precaution, then brought them back after patching. Overseas, Moodle hosting providers took the school and university sites they manage offline for hours while they patched.
• Australian government sites were hit. The ABC reported that cyber.gov.au and other Australian government websites had outages. A spokesperson for the Home Affairs Minister said "some websites are temporarily unavailable" while risks were managed.
• Attacks started fast. Security firms reported early attempts as the patches landed. When it published its alert, the US agency CISA said it hadn't observed exploitation, and Australia's cyber agency said it wasn't aware of successful attacks in Australia. Experts expected that to change quickly.
• A firewall only buys time. Companies like Cloudflare added temporary blocking rules. Their own advice is clear: it's a stopgap, and updating PHP is the only real fix.

Many sites came back within hours of the patch. But the patch only protects a server once someone actually installs it, and there are a lot of PHP servers out there.

What does PHP2Shell mean for families?

For most parents, this is something to be aware of, not something to fix. Your child's school or its provider does the patching. Here's what helps at home this week:

• Save work early. If the school portal or learning platform goes down, a draft saved on the computer isn't lost. Encourage your child to submit a bit before the deadline, not at 11:58pm.
• If a site is down near a deadline, have your child take a screenshot of the error and email the teacher. Try: "The portal was down when I tried to submit at 7pm. Here's my work attached."
• Be extra careful with "security update" emails. Big news stories bring scam emails. A Malwarebytes researcher warned that hijacked sites can be used to send phishing. If an email says "reset your password now", go to the site yourself rather than clicking the link.
• Use different passwords for different sites. If a school or club site tells you its data was exposed, change that password, and anywhere else you used the same one.

This is also a good moment for a calm chat about online safety, without the panic. Our guide to helping kids with homework without doing it for them has a few scripts for keeping these conversations short and friendly.

What should schools and teachers do?

If you're a teacher, you probably don't run the servers. But you can ask the right question. Try sending your IT team or provider this:

"Are all our PHP-based systems, including Moodle, the website and any plug-in tools, updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a patched vendor version?"

A few more things worth knowing:

• Older PHP is the biggest worry. PHP 8.1 and older no longer get official updates. The PHP team released minimal source fixes for 7.4, 8.0 and 8.1, but the safe answer is moving to a supported version.
• PHP hides inside other products. Australia's cyber agency, the ACSC, advises organisations to identify where PHP runs in their systems. CISA adds that PHP is often a component of other software, so it isn't always obvious.
• Updating WordPress isn't enough. The fix is in PHP, not WordPress, so it's the server or host that has to update.
• Plan for downtime. Have a backup way to share work and extend deadlines if a platform goes dark again.

Schools that think they've been affected can contact the ACSC on 1300 CYBER1 (1300 292 371). If you're thinking about the bigger picture of AI in your classroom, our notes on what AERO's new advice on AI in schools means for teachers pair well with this story. The same AI that writes essays can now find decades-old bugs.

Engineering notes: what this means for Archimedes

You might wonder whether this affects us. Our site runs on Elixir and Phoenix, the same stack behind the Archimedes tutor, as we explained in how we built this edtech newsletter.

Our own code doesn't run on PHP, so this particular bug isn't in it.

That isn't a reason to relax. Three things we're taking from PHP2Shell:

• Every stack has a foundation you didn't write. Elixir runs on the BEAM, the Erlang virtual machine, and much of the BEAM is written in C, just like PHP's engine. It's built differently, giving each process its own memory heap, but different isn't the same as immune.
• Your tools are part of your stack. Email services, hosting, analytics and plug-ins are other people's code. Knowing what they run on, and reading their notices, matters as much as your own code.
• AI now finds the hard bugs. Flaws that were "too complex to exploit" aren't any more. For a small team, that means keeping dependencies up to date by habit, not just in a crisis.

We're a small team, so we'd rather tell you what we know than make big promises. This one isn't in our code. The lesson applies to us anyway.

FAQ

Is my child's data at risk from PHP2Shell?

It depends on whether, and how quickly, their school's systems were patched. The flaw can let attackers take over an unpatched server or read its memory, and many hosting providers patched within hours. If a school or service tells you data was exposed, change that password.

Was Moodle affected by PHP2Shell?

Moodle runs on PHP, so Moodle sites on an unpatched PHP version are exposed, even though the flaw isn't a bug in Moodle itself. Moodle HQ took its public sites offline as a precaution, patched them, and urged anyone hosting their own Moodle to update PHP immediately.

How do I know if a website has been fixed?

From the outside, you usually can't tell, because the fix happens on the server and it's up to the site owner or their host. If you run a site, check your PHP version against the fixed releases: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you don't, follow the school's or service's updates.

Who found the PHP2Shell vulnerability?

Security firms Calif and Wiz Research found the flaws using frontier AI models, working with OpenAI and the PHP security team. They reported them privately in August 2026 so a fix could be prepared. Details leaked a day before the planned release on 21 October.

Want plain-English notes like this when edtech news breaks? Get the next issue by email.

By Thomas Heal, founder of Archimedes.