The PHP alert: what schools need from their cyber response, today and next term

01 / The current position

The fixes arrived yesterday. The assurance work belongs in today's school.

On 21 October, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, flaws that can permit code execution without a login. PHP runs behind web services; its presence may be invisible to the person using them. A website, application or bundled component therefore needs a technical dependency check, rather than an assumption based on its brand.1

The NCSC urges organisations to identify PHP across their infrastructure, prioritise exposed systems and apply fixes. Where protection cannot be applied promptly, taking an affected service offline may need consideration. A precautionary closure, a vulnerable installation and a confirmed compromise are different findings. This review establishes no count of affected schools.2

02 / The continuing lesson

Earlier incidents explain why a forwarded warning is an incomplete response.

In December 2021, Log4j showed how a widely embedded software component could leave organisations dependent on suppliers to establish where it was used. That was a Java logging vulnerability, with a different mechanism. The useful comparison is the discovery problem: a familiar application name does not reveal every component underneath it.3

The NCSC's June 2021 education alert documented ransomware incidents involving lost coursework, financial records and other school information. Those attacks were not the current PHP flaws. They demonstrate why the consequence belongs in school language. A technical ticket is important; leaders also need to know which records, decisions and people would be affected by interruption.4

03 / Act now

Start with one responsibility record, then resolve the exceptions.

Ask existing IT, hosting and application providers for a service-by-service position. Record the service, technical owner, PHP dependency, exposure status, remedy, completion evidence and next update time. Use an explicit unresolved status when a provider has not answered. A trust-wide assurance statement should identify exceptions at individual schools and shared services.

The technical owner should confirm the fixed running build, including any documented vendor backport, and that necessary restarts or redeployments have taken effect. Updating a website's visible content does not establish this. If suspicious activity is found, preserve evidence and involve incident-response and information-governance leads. Exposure alone does not establish a personal-data breach or an automatic reporting duty.1

Give the school business professional a clear decision where cost, interruption or unsupported software prevents progress. Give the headteacher an operational assessment and governors a concise account of unresolved risk. The point is to shorten the route between technical discovery and a decision someone has authority to make.

For schools in England, DfE's cyber standard assigns coordination to the senior leadership digital lead and technical action to IT support, with other leaders involved according to consequence. Its baseline includes a 14-day period for relevant vulnerability fixes. The present PHP advice calls for immediate action; the baseline should not be interpreted as a reason to leave known exposure waiting. Confirm the response against the current advisory.5

04 / Protect the school day

Test the work people must still be able to complete.

Select a realistic interruption: normal sign-in is unavailable when attendance must be recorded, a safeguarding contact is needed or families require an urgent update. Ask which authorised colleague can obtain current information, which alternative channel works and how temporary records will be protected and reconciled. Use existing approved arrangements; avoid creating uncontrolled copies of sensitive records.

Include the colleague who opens the school, the designated safeguarding lead and someone outside the usual technical team. Test restoration as well as the workaround. A successfully copied backup and a recovered service answer different questions. Record what actually worked, the interruption tolerated and the action needed before the next exercise. DfE's England standard connects cyber response with leadership, safeguarding, business continuity and recovery.5

05 / Commission useful expertise

Ask cyber companies to demonstrate a defined outcome.

A good cyber specialist should make the school more capable of understanding and controlling its position. Begin with the gap the school cannot resolve. Specify the systems covered, access permitted, operational constraints and evidence required. Agree how the specialist will work with existing support teams and who owns each resulting action.

A trust should also establish whether the commission covers the centre, every school or only a sample. A small maintained school should ask how the work joins local-authority and existing support responsibilities. Compare proposals on coverage, interpretation, follow-through and the ability to demonstrate improvement. That makes the purchasing decision more useful than comparing a headline service description or assuming that a familiar certificate settles this incident.

Exposure assessment can establish what is present; managed detection can help identify suspicious activity; incident response can investigate and contain suspected compromise. Independent assurance and recovery exercises can test whether controls work. These are different commissions. A scan needs interpreted findings, monitoring needs a response route, and a remediation claim needs verification. Ask for a usable result rather than an undifferentiated assurance badge.

06 / Future prevention

Build a response that can move faster than the next maintenance visit.

Keep service and dependency records current, including support end dates and who receives security notices. Retire redundant services through a controlled process. Agree an emergency update route with authority, testing, rollback and verification, including holiday and out-of-hours cover. Routine schedules should accommodate a faster response when the risk demands it.76

Use access controls, monitoring and recovery arrangements as complementary protections. Multi-factor authentication remains valuable for account security; it cannot repair a flaw exploitable without authentication. Similarly, a protective web filter or firewall rule needs its limits understood. The PHP project says an update is the complete solution for these vulnerabilities. Avoid allowing an interim measure to become an unreviewed permanent exception.1

07 / The next decision

Use the next 30 days to leave a stronger operating record.

School Connection suggests three stages, alongside the immediate response. First, reconcile critical services and assign every unresolved item. Next, review emergency support arrangements, unsupported dependencies and the evidence still missing. Then run one continuity and restoration exercise and bring its findings to the leadership team. This is an editorial planning sequence, not a statutory 30-day deadline.

Governors should receive the exception list, decisions taken, evidence of completion and the next test date. Where expertise or funding is needed, connect expenditure to a specific improvement that can be checked. The durable outcome is a school that can explain who acted, what was verified and how essential work continues when the next alert arrives.

For heads, business professionals and governors

Four questions to close the review

1. Which services remain unresolved, who owns each answer and when is the next update due?
2. What evidence confirms that the running service is fixed, including vendor-managed dependencies?
3. Can authorised staff perform essential attendance, safeguarding and communication tasks during an outage?
4. What measurable improvement will any cyber specialist deliver, and who will verify it?

Continue the evidence trail

How this develops our earlier coverage

• Review third-party access and the school attack surface ↗
• Turn backup assurance into a restoration test ↗
• Rehearse a response staff can use ↗

The continuing record

Read the connected evidence and analysis

• After the PHP patch: can your school prove the risk is closed? ↗