PHP exploitation reports change the question behind an independent school’s all-clear

Begin with what the school can reasonably conclude

An independent school needs a service it can rely on and an account of its security that leaders can understand. A message confirming that an update is complete is part of that account. A bursar, director or governor may also need to know which application it covered, who carried out the work and what the school can conclude about the period before protection was in place.

Those questions became more pressing after the earlier PHP alerts. NHS England’s 29 October update records exploitation evidence and the original flaws’ inclusion in the US known-exploited catalogue. It also says its cyber centre had not observed mass exploitation at that point. Microsoft’s 30 October advisory describes PHP2Shell as actively exploited. These are developments in the public threat account, rather than a count of affected independent schools.12

The practical distinction is between a software dependency, a period of exposure and an incident established by evidence. Each calls for a different explanation. A school can ask precise questions about the service it uses while retaining that distinction, giving the technical team room to establish the facts and leadership enough information to make a proportionate decision.

Our 26 October continuation examined configuration advice and Windows rebuilds. The 27 October feature followed parliamentary scrutiny into supplier responsibility. This piece carries that work forward into the independent school’s own arrangements: how the application is delivered, where responsibility sits and which questions an assurance actually settles.

Follow responsibility through the service you have bought

Independent schools can commission admissions, finance, parent communications and residential services through different routes. A school group may combine central provision with local purchases. Start with the application staff recognise and establish the organisations supporting it. The useful picture follows the school’s actual service through those relationships, with someone accountable for explaining the whole arrangement.

Microsoft’s 30 October guidance illustrates why that matters. It distinguishes Microsoft-managed platforms from customer-managed resources, including software installed or bundled by customers. Windows Update does not patch separately installed PHP. Relevant automatic guest updates depend on enabled features and maintenance arrangements, while custom images and containers have their own responsibilities. Those details concern the specified Microsoft environment; they should be checked against the school’s actual deployment.2

An admissions application may, for example, be maintained by a developer on a separately hosted platform. A platform update and an application update can belong to different organisations. Ask who maintains the application, who verifies that the updated version is running and who will explain any uncertainty. This is a delivery question to investigate, not an assumption about the architecture of independent-school software.

Bring the answers into one clear account of the service. Keep detailed configurations and credentials in protected technical records. The leadership summary can identify the responsible parties, the relevant work, its verification and the remaining decision. That helps a bursar pursue an exception without having to interpret the name of a platform as an assurance about every component within it.

Connect earlier exposure with the operating decision

A fix and an assessment of earlier activity serve different purposes. The NCSC alert includes prior-compromise assessment where immediate updating or disabling is not possible. PHP’s release and technical advisories describe the flaws and corrective releases. Those documents support the technical response, while the conclusion about an individual school service needs evidence from that service.345

Ask the responsible technical people when relevant protection was in place, what is known about earlier exposure and which evidence supports their conclusion. The answer may support closure, further investigation or a recorded uncertainty. Where specialist assessment is recommended, agree its scope, access and operating constraints with those already responsible for the service.

For a boarding school, timing forms part of the decision. A service used by residential staff can matter after the administrative office has closed. Establish the activity it supports, the authorised information staff need and the point at which a temporary restriction would affect them. The school can then weigh the technical advice against a clear account of the practical consequence.

Keep the bursar, digital lead and relevant operational leader working from the same position. If a precautionary pause or further investigation is needed, someone should explain the restriction and the decision required. When normal use can resume, staff need to know which functions are available. This turns work spread across several organisations into a service decision the school can manage.

The value of external expertise lies partly in making that judgement possible. A specialist can investigate a defined uncertainty, explain the strength and limits of the findings and work with existing support on the next step. Agree who will carry the findings through, rather than leaving the school with a report whose recommendations have no owner.

Make the next assurance part of a dependable continuing service

The NCSC’s annual review, published on 3 November, adds wider context. Its incidents from September 2025 to August 2026 show familiar vulnerabilities, stolen credentials and social engineering remaining central to successful compromises. It also highlights supplier dependencies. Observed AI use had not enabled a novel class of attack. These are findings across UK organisations, from an earlier reporting period, rather than independent-school incidence or a further PHP finding.6

For school leaders, the useful direction is to keep service responsibilities working between alerts. Agree who maintains each component, how urgent changes are escalated and how a provider will communicate with the school when a dependency is affected. Check how restoration will be tested and how staff will work during an interruption. The resulting service should be understandable to the people funding it and depending on it.

An adviser or cyber specialist can help the school establish that picture, test an arrangement and interpret the results. The commission should say what is covered, what evidence will be delivered and how it fits the existing support. Directors and governors can then consider the finding, the operating consequence and the resources needed, with technical staff retaining the detailed assessment.

A useful finish is a concise account of current protection, what is known about the earlier period and any question still open. Give unresolved work a responsible person and a review date. Bring the next review back to what changed in practice. That gives the school a stronger basis for accepting an assurance and a clearer relationship with the specialists who support its digital services.