Schools, Colleges and Moodle: Responding to the PHP2Shell Vulnerability
Education settings run a surprising amount of PHP. School and trust websites are often built on WordPress, many colleges and schools use Moodle as their learning platform, and parent portals, booking systems and bespoke admissions forms frequently sit on the same technology. When the critical PHP2Shell vulnerabilities were fixed on 21 October 2026, all of those were potentially in the firing line.
The main article explains what happened, including the government websites taken offline and how quickly attackers moved: PHP2Shell and the Cyber Essentials 14-day patching rule. Here we work through the systems a school, college or multi-academy trust is most likely to have.
System by system
Your public website
Most school websites are supplied and hosted by a specialist provider or a local agency. Ask them to confirm, in writing, the date they updated to a fixed PHP version (8.5.12, 8.4.27, 8.3.36 or 8.2.35). If your trust has a different website supplier for each school, you'll need an answer from each one. That alone is a good argument for keeping a single register of who hosts what.
Moodle and other learning platforms
Moodle is written in PHP, so the PHP version underneath it matters as much as the Moodle version itself. If Moodle is hosted for you, ask the host. If it runs on a server in school or in your own cloud account, your IT team or support provider needs to update PHP on that server and restart the web service. Remember that a learning platform holds pupil data and staff accounts, so treat it as a priority system, not an afterthought.
Parent portals, payments and bookings
Third-party platforms for payments, clubs and parents' evenings are usually cloud services. Under Cyber Essentials v3.3, cloud services that hold your data can't be left out of scope, so it's reasonable to ask each provider whether they were affected and what they did about it.
The forgotten ones
Old event microsites, a sixth-form site nobody updated after a rebrand, a staff intranet on an old server in the comms cupboard. These are the systems most likely to be running PHP 8.1 or older, which may never receive a fix. If they're not needed, switch them off. Under Cyber Essentials, unsupported software must be removed or kept away from the internet.
Working with your IT support provider
Many schools rely on a managed service provider. The NCSC's guidance on responding to active exploitation recommends that organisations make sure their suppliers are contractually committed to fixing exploited, internet-facing vulnerabilities quickly. When your support contract next comes up for renewal, that's worth adding.
Timing in a school year
Critical vulnerabilities don't wait for half-term. The NCSC expects a wave of urgent updates as AI speeds up the discovery of old flaws, so schools need a way to patch during term time without disrupting teaching. Automatic updates, a named person who can approve emergency changes, and a plan for briefly taking a site offline will cover most situations.
Cyber Essentials gives you a maximum of 14 days to apply high and critical updates. We recommend 7 days as your normal target, and within hours when a flaw is being actively attacked, as PHP2Shell was.
Why Cyber Essentials helps schools and trusts
For education settings, the Cyber Essentials benefits are practical: a clear checklist that covers every school in a trust, an independent check of your controls, and evidence to show governors and trustees. If you'd like to know how to get Cyber Essentials across a trust or a single school, our Supported service includes help with scoping, which is often the hardest part in education. More guidance is in our education resources.
Comments