PHP2Shell Flaw: What Schools Should Do Today

By the Vidh Security Research Team | 22 October 2026 | 6 min read

On 21 October 2026, the PHP project released urgent fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Much of the web runs on PHP, including many school websites, admission forms and fee portals.

There is no need to panic, but it deserves attention this week. Amazon Web Services (AWS) reports the flaw is being "broadly exploited in the wild", and national cyber agencies including the US CISA, the UK NCSC and India's CERT-In have urged immediate patching, with CERT-In rating it Critical. This guide is for principals, owners and teachers. No technical knowledge needed.

What to do today: a 5-step checklist

1. Ask in writing. Send the five questions below to whoever runs your school software, website and fee portal.
2. Expect a clear answer within a day. A vague reply is itself a warning sign.
3. Ask for a compromise check from 17 October 2026 onwards. AWS saw the first attack attempt on that date, four days before the fix.
4. Change important passwords after patching. Start with admin, accounts and payment logins, and turn on two-step login (2FA) wherever it's offered.
5. Brief your staff and parents. The school will never ask anyone for an OTP or password over a call, SMS or WhatsApp.

What is PHP2Shell, in plain language?

PHP runs on a web server. It builds pages, handles logins and forms, and talks to the database. PHP2Shell is a set of bugs in PHP itself, not in any one website or app.

With specially crafted web requests, an attacker with no password or account can make a vulnerable server run commands of their choosing ("remote code execution"). Wiz, the researchers who found the flaws, also showed attackers can read server memory that may hold passwords and login tokens.

The key facts:

• Severity: both flaws are rated 9.2 out of 10 (Critical) by the PHP project.
• Fixed versions: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October 2026. Anything older is affected. Wiz says every PHP version back to 5.4 has at least one of the flaws.
• No complete workaround: PHP says updating is the only safe choice.
• PHP 8.1 and earlier get no official update; your provider needs a backported fix or an upgrade.
• Attacks have started. AWS saw an attempt on its decoy servers on 17 October and called it broadly exploited by 21 October. The US agency CISA had seen no exploitation when it published on 21 October, so the picture is still developing.

Why schools should pay attention

Schools are not being singled out, but common features of school IT raise the risk:

• PHP is often hidden. Much software uses PHP without saying so, as CISA notes.
• Small teams. School sites are often run by a small outside team or on low-cost shared hosting, where nobody may be watching for urgent fixes.
• Old versions linger. Scans cited by Recorded Future suggest most PHP servers that reveal their version run versions with no official fixes.
• Sensitive data. Names, phone numbers, addresses, ID numbers, fees, health notes and marks are valuable to fraudsters.

Is your school affected? Questions to ask your provider

Send these in writing and keep the replies.

1. "Does any of our software, website, admission form or fee portal use PHP?"
2. "Which PHP version is each one running right now?"
3. "Has each been updated to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or to a backported fix for CVE-2026-109618 and CVE-2026-109619? On what date?"
4. "If any system runs PHP 8.1 or older, what is the upgrade plan, and what protects us until then?"
5. "Have you checked our servers for signs of compromise from 17 October 2026 onwards?"

Simple warning signs anyone can spot

These don't prove a hack, and their absence doesn't prove you're safe:

• Admin or staff accounts that nobody remembers creating
• Changed pages, odd pop-ups or redirects on the school website
• Password-reset emails or login alerts that staff didn't request
• Parents receiving fake fee or "update your details" messages that quote real names, amounts or roll numbers

If you notice any of these, contact your provider straight away. Don't wait until you're sure.

For your IT person or provider (short technical box)

• Version: check the PHP version the web server uses (it can differ from php -v). Fixed: 8.2.35, 8.3.36, 8.4.27, 8.5.12+, or a backported package.
• If you can't patch today: apply PHP's interim measures from the official advisory (for example session.upload_progress.enabled=0, an administrative memory_limit=-1, a low post_max_size) and restart every PHP worker. PHP says these reduce exposure but do not make you safe. If a public-facing system can't be patched or protected quickly, CISA and the UK NCSC advise taking it offline.
• Hunt from 17 Oct 2026: look for POST requests with PHP_SESSION_UPLOAD_PROGRESS in multipart uploads (AWS), memory-limit errors or bursts of HTTP 500s, oversized PHPSESSID cookies, and PHP or web-server processes starting shells or download tools. Application logs may show little, because the attack runs below the application.

How to fix it and limit the damage

1. Patch first. Updating PHP and restarting the web server is the real fix.

2. Assume passwords and keys may have leaked. After patching, change admin and database passwords, and ask your provider to rotate payment, SMS and email keys.

3. Turn on 2FA for every principal, admin and accounts login.

4. Check your backups. Keep a recent backup away from the main server, and test that it restores.

5. Warn people early if needed. If data may be exposed, tell staff and parents to expect fake fee or OTP messages and to verify with the school office.

Check your local reporting rules

Most countries have rules on reporting cyber incidents and protecting children's data, so check yours with your legal adviser. Two examples from India:

• CERT-In issued Vulnerability Note CIVN-2026-0510 (Critical) on 21 October 2026. Its 2022 Directions require service providers, data centres, body corporates and government organisations to report specified cyber incidents within 6 hours of noticing them. Your software or hosting provider is likely covered. Ask your legal adviser whether your school's trust, society or company is too.
• DPDP Act: the Digital Personal Data Protection Rules were notified in November 2025, with duties phased in over about 18 months. Schools hold a lot of children's data, so now is a good time to build the security habits the law will expect.

Longer term: questions to ask when choosing school software

PHP2Shell won't be the last serious flaw. When you renew or choose school software, ask:

• Who applies security updates, and how fast? Is it a dedicated team, or a busy office remembering to do it?
• Is the underlying technology still supported by its makers?
• What security evidence can you show? Independent audits, 2FA for all users, and a breach-notification commitment in the contract.
• Can we export all our data at any time, in a standard format?

Fewer scattered systems also means fewer places for data to leak; see our posts on a single student record and AI school management software vs. ERP.

If you're reviewing your options anyway, modern, cloud-based, AI-powered school platforms such as Vidh.co are worth a look. No software is immune to flaws. What counts is how quickly they are fixed, and by whom.

Frequently asked questions

What is PHP2Shell?

Two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, that can let an attacker with no login run commands on an unpatched web server. PHP fixed them on 21 October 2026.

Which PHP versions are safe?

PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and later, or versions with a backported fix. PHP 8.1 and older get no official fixes.

How do I know if my school's software uses PHP?

Ask your provider in writing which PHP version each system runs and when it was patched.

Is PHP2Shell being exploited?

Yes. AWS saw a first attempt on 17 October 2026 and reported broad exploitation on 21 October.

Does my school have to report a breach?

Check your country's rules. In India, for example, organisations covered by CERT-In's 2022 Directions must report specified incidents within 6 hours. Take legal advice on your school's position.

See how a modern school platform works. Book a free 30-minute demo by emailing hi@vidh.co.

About Vidh: Vidh (vidh.co) is an AI-powered school platform built by Vidh Labs in Bengaluru. Schools in any country can use it, and it adapts to any curriculum.

This article is general information, not legal or security advice. Facts are current as of 22 October 2026 and may change.

Sources: PHP security advisory · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp · AWS Security Blog · CERT-In CIVN-2026-0510 · CISA alert · UK NCSC · Wiz Research · Recorded Future · CERT-In Directions 2022 · PIB on DPDP Rules