After the PHP patch: can your school prove the risk is closed?

01 / The development

Three developments need three distinct answers

PHP’s 21 October releases fixed the original two critical flaws. Its 23 October notice addressed a further, unusual session-handling configuration. On 26 October, Windows package rebuilds added a Brotli dependency fix without changing the PHP runtime version. These are separate checks, not evidence that every patched service remains vulnerable.1

CERT-EU’s updated advisory explains the narrow configuration behind the further issue. The technical team should establish applicability, any mitigation and the next review. NCSC-NL’s live product information also helps identify embedded dependencies. Neither source tells a school that its own installed product is affected without verification.23

A leadership summary should therefore distinguish the original patch, subsequent configuration advice and any applicable package dependency. One green box marked PHP is too broad. Equally, a new advisory should not automatically reset every completed action to red. The right status follows the actual service and the evidence available.

02 / The evidence

Ask for the running service, the date and the exceptions

Ask the responsible provider for a short written record naming the service, the environment checked, the relevant software build or documented vendor fix, the completion time and the person responsible. Where restarts or deployment changes were necessary, ask whether they took effect. A purchase invoice or a screenshot of a download is not evidence that the live service uses it.

Trusts should request the exceptions behind any group assurance. A shared platform may be complete while an individual school website, old application or separate hosting account remains unresolved. Record each exception against the school or shared service it affects. Avoid copying sensitive technical details into a widely circulated board pack; maintain the detailed record securely and provide a proportionate summary.

Use four plain statuses: applicability confirmed and action verified; not applicable with a stated reason; temporary protection with a dated follow-up; or unresolved. The last category is useful. It prevents silence from turning into an assumption of safety and gives the business professional a clear list to pursue.

03 / In practice

Test the consequence through one ordinary school morning

Select a realistic interruption with the safeguarding lead and operational staff. Suppose a parent portal or public website is unavailable at arrival time. Establish how families receive information, how urgent messages reach the right person and how staff distinguish the alternative channel from an impersonation attempt. Then ask what changes if the interruption lasts through the afternoon.

Where an essential record system is involved, identify the authorised information staff need, how it remains current and who reconciles changes after restoration. Do not create uncontrolled copies of pupil information simply to demonstrate preparedness. The school’s information-governance lead should agree the access, protection, retention and disposal arrangements.

The purpose is to discover a broken handover before an emergency. Record what staff actually demonstrated, including any contact number that failed or instruction that depended on the unavailable system. An exercise that reveals a small weakness and assigns a remedy is more useful than a policy reviewed without testing.

04 / Leadership action

Commission an answer to a defined gap

Existing hosting and IT providers should first account for the work within their responsibilities. Where the service inventory is incomplete, vulnerability assessment can establish what exists and who owns it. Where a supplier’s completion claim needs independent scrutiny, commission authorised verification with an agreed scope and precautions to protect availability.

If suspicious activity is identified, incident-response and forensic support can help preserve evidence and guide containment and recovery. Managed detection services are useful only when the monitored systems, escalation arrangements and response authority are explicit. Buying a named service category does not establish that the school’s relevant application is covered.

Ask prospective specialists to describe the evidence they will deliver, who interprets it and what happens when a critical finding arrives outside school hours. Agree responsibilities with current providers before testing. A technically impressive report has limited operational value if nobody is responsible for completing or verifying the remedial work.

05 / Delivery

Give governors a decision record they can use

The headteacher or trust executive should receive a one-page summary showing essential services, outstanding exceptions, continuity arrangements and decisions required. The governing discussion is about accountability, resources and residual uncertainty. It should not expose detailed infrastructure information unnecessarily or encourage governors to make technical configuration changes themselves.

Finance and procurement teams can review whether support contracts define emergency patching, out-of-hours communication, evidence of completion and exit responsibilities. A weakness in the response is a reason to examine the contract and delivery together. It is not, by itself, a reason to replace a supplier before understanding the facts.

Where a deadline cannot be met, record the responsible executive’s decision, the advice received, the temporary arrangement and the next review time. Avoid an indefinite acceptance of an unspecified risk. The practical question is what will happen next, who has agreed to do it and what evidence will allow the exception to be closed.

06 / Next steps

A short close-out review for the next working day

Begin with the outstanding service list. The IT lead should separate unanswered requests from verified actions and identify which later advisories apply. The business professional should confirm escalation contacts and any work requiring approval. The safeguarding lead should check the alternative communication route. The executive should settle unresolved ownership or resource decisions.

Before closing the review, sample the evidence for one important service and test one continuity handover. Set the next check against an actual pending action or further official release. A review date should follow the state of the work rather than become a decorative annual entry. Retain the original alert and subsequent decisions so the reasoning remains understandable.

The strongest outcome is a school able to explain its position accurately: what was exposed, what changed, what was verified and what remains uncertain. That account supports the next alert as well as this one. It gives leaders a repeatable response that depends on evidence and workable relationships rather than on the wording of a reassuring email.

Leadership questions

Questions that turn the development into a governing conversation.

What we are monitoring next

Publication is the beginning of the watch.

• Further primary-source publications and changes to official guidance.
• Documented operational lessons that can be shared without identifying pupils.
• Completion and verification of locally agreed actions.

Continue the evidence trail

How this develops our earlier coverage

• Start with the 22 October PHP response feature ↗