Last updated on October 22, 2026 at 02:09 pm
Updated 3pm: We’ve proactively blocked access from the internet to exposed servers and related ports for a small group of schools as a precautionary measure.
We’re reaching out to the impacted schools with more information.
Please note that schools should still follow the guidance outlined below for other relevant services and systems.
10am: We’re aware of two critical vulnerabilities in PHP impacting websites and other online services from a number of providers (CVE-2026-109618, CVE-2026-109619).
If exploited, these vulnerabilities could allow unauthenticated remote code execution (RCE) on impacted web services.
We’re currently reviewing the issue and potential mitigations for N4L-managed services.
- What schools need to do
Check with your vendors: if any of your school web services (for example, WordPress) or on-premise systems use PHP, we strongly recommend you check with the software provider and your IT contact to ensure they’re aware of the issue and are taking appropriate action. - Upgrade school-managed systems: we strongly recommend you upgrade any school-managed services using PHP as per guidance from the National Cyber Security Centre here.
You can find more information in this advisory. If you have any questions, please reach out to Customer Support at [email protected].