Few people think twice about the code behind school websites and enrolment portals. That changed on 21 October, when researchers using AI spotted a major flaw in PHP – a programming language that runs behind the scenes on 70% of the world’s websites.
What made this flaw so alarming was that it could let hackers use a tool called PHP2Shell to take full control of those websites and potentially grab all their data.
This discovery prompted an urgent call by cybersecurity agencies worldwide for PHP users to update immediately or take their sites offline until they could patch.
While the crisis has now moved from emergency to clean-up, Anthropic’s deputy security chief, Jason Clinton has warned that “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better.”
‘Patch, confirm it took, and keep the panic in check’
With PHP powering many school sites and online portals, one expert said ICT departments should act fast if they haven’t already.
“These are real critical bugs, two unauthenticated remote code execution flaws in PHP patched on October 21, so schools should get patched promptly,” Douglas McKee, Director, Vulnerability Intelligence at global cybersecurity company Rapid7, told The Educator.
McKee said the scary headline, that PHP runs around 70% of the web, is roughly true for sites where the server language is known, and it covers many school portals and Moodle installs.
“Here is where I pump the brakes though. A large, exposed surface is not the same as many compromised servers, and landing this reliably across different PHP versions and host setups is genuinely hard,” he said. “Patch, confirm it took, and keep the panic in check.”
‘Treat those systems as exposed until proven otherwise’
For schools relying on an IT provider to keep their PHP-based systems secure, a verbal assurance is no longer enough. McKee said the question Principals should be asking is simple, and the answer will reveal just how exposed they are.
“If your provider cannot put it in writing, treat those systems as exposed until proven otherwise,” he said. “Asking for written confirmation per system is exactly right, and that covers the website, enrolment forms, the parent portal and Moodle.”
McKee said scanning for exposed PHP is cheap and already happening, so exposure starts the moment a system is reachable and unpatched.
“Prioritise anything internet-facing, and look hardest at Apache with mod_php, since that is the demonstrated unauthenticated path.”
Who’s on the hook when the system fails?
When a vulnerability strikes, the question of who is responsible for fixing it can quickly become a game of pass the parcel between Principals, IT providers and education systems. McKee said everyone has a role, but not an equal one.
“The worst place for accountability to sit is nowhere, and that is where plenty of schools land, nobody quite sure who owns the patch,” he said. “My practical take is that it is shared, but it does not split evenly. The IT provider owns the work and should be contractually on the hook to confirm it in writing.”
McKee said the Principal owns the risk, because it is their students and families whose data is on the line, adding “you cannot outsource that the way you outsource the work.”
“Whoever oversees the school system should define the security baseline every school has to meet, and give schools a clear picture of what they are running.”
The first call that matters most
Most Principals picture a cyberattack as a black screen and a ransom note. But when a hacker slips in through a flaw like this one, McKee said the reality can be far less obvious.
“With this kind of flaw, a Principal might see nothing at first, which is what makes it dangerous,” he said. “When there are signs, they are quiet, a site acting strangely, files nobody created, odd traffic spikes.”
McKee said who a Principal calls first could make or break the response.
“If you suspect someone got in before the patch, the first call is not a vendor hotline, it is whoever can run incident response, your provider’s security lead or an external IR firm, so they contain it and preserve evidence before anything is lost,” he said.
“Right behind that, start breach notification through the OAIC’s scheme and report it to ReportCyber. Confirm your obligations, since they differ for government and non-government schools.”