Cybersecurity is rarely at the top of a school leader’s daily to-do list. Between managing budgets, supporting staff, improving outcomes and looking after pupils, there are always competing priorities. However, a recent warning regarding PHP Vulnerabilities from the UK’s National Cyber Security Centre (NCSC) is something schools should pay particular attention to.
On 21 October 2026, the NCSC issued an urgent alert concerning two critical security vulnerabilities affecting PHP, a technology used behind the scenes by countless websites and online applications.
While the term PHP might mean very little to most headteachers or school business managers, the potential consequences of these vulnerabilities are something every school should understand.
PHP is a programming language that helps websites and online applications function. It is widely used by popular website platforms such as WordPress, Drupal and Joomla, as well as many bespoke online systems.
Your school might be using PHP without even knowing it.
For example, it could be running behind your school’s website, an online booking system, a parent communication portal or a bespoke application used by staff.
The concern is that two newly disclosed vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow cybercriminals to execute malicious code remotely on vulnerable servers, potentially without needing a username or password.
Both vulnerabilities have been given a critical severity rating of 9.2 out of 10.
Put simply, if a vulnerable system is successfully attacked, criminals could potentially gain control of the server, steal sensitive information, disrupt services or use the compromised system to launch further attacks.
For schools, which hold considerable amounts of sensitive information about children, families and staff, these are risks that must be taken seriously.
But there is no need to panic. Just because a school uses a website or online application built using PHP does not automatically mean it has been compromised.
The important questions are whether the systems use an affected PHP version and whether the appropriate security updates have been installed.
Security fixes were released on 21 October 2026, meaning website hosting companies, software suppliers and IT teams can now take action to address these vulnerabilities.
However, some schools may be relying on older websites or applications that are no longer regularly maintained. Others may have limited visibility of the technology their third-party suppliers use.
This is where the biggest concerns arise.
A school could have excellent antivirus protection, strong passwords and secure laptops, yet still face cybersecurity risks through a poorly maintained website or third-party online application.
It is a useful reminder that cybersecurity extends well beyond the computers sitting in classrooms and offices.
What should schools do now?
The good news is that schools do not need to become technical experts to respond appropriately.
There are five sensible steps every school should consider.
1. Contact your website provider — Ask your website hosting company whether your school website uses PHP, whether it has been assessed against the latest vulnerabilities and whether any necessary security updates have been completed. Request written confirmation so that you have a record of the response.
2. Speak to your IT support provider — Your IT team should review any school-managed servers, internally hosted applications and other systems that might use PHP. Particular attention should be given to systems accessible from the internet.
3. Review your third-party suppliers — Schools increasingly depend on external providers for online services, including payments, bookings, communications and administration. Where relevant, ask suppliers to confirm that their systems have been assessed and appropriate remedial action taken.
4. Check that security updates are being managed — Applying security updates is one of the most effective ways of reducing cybersecurity risks. Schools should have confidence that their systems are regularly reviewed, supported and maintained, rather than relying on somebody remembering to check them occasionally.
5. Keep cybersecurity on the leadership agenda — Cybersecurity is not simply an IT issue. It is a school-wide responsibility involving leadership teams, governors, trustees, staff and external suppliers. Understanding which systems the school relies upon, who manages them and how security risks are addressed is an important part of effective governance.
Although this particular alert concerns PHP, it highlights a much wider challenge facing schools.
Technology has become essential to almost every aspect of school life, but the responsibility for managing it is often spread across multiple organisations.
A school’s IT provider might manage its network and devices, while another supplier maintains its website, a separate company manages communications and other providers host important online applications.
This arrangement is perfectly normal, but it can create gaps in responsibility if schools are unsure who is looking after what.
When a critical security warning appears, schools need to know who is responsible for investigating it and taking action.
This is why having a clear understanding of your school’s digital systems, supplier responsibilities and cybersecurity arrangements is so important.
It is also why regular IT reviews, effective supplier management and a proactive approach to security should be part of every school’s wider technology strategy.
At One Education, we understand that schools need technology that works reliably, securely and without creating unnecessary additional workload for staff.
Our IT Service works with schools and trusts to help them manage their technology, understand emerging cybersecurity risks and make informed decisions about protecting their systems.
Whether that involves reviewing existing infrastructure, assessing potential vulnerabilities, strengthening security arrangements or liaising with third-party suppliers, our focus is on providing practical, straightforward advice that schools can act upon.
The latest PHP warning is an important reminder that cybersecurity threats continue to evolve. However, with the right support, clear responsibilities and a proactive approach, schools can significantly reduce their exposure.
Our advice is simple: don’t ignore this warning, but don’t panic either. Speak to your IT provider, check with your website supplier and make sure the appropriate security measures are in place.
Protecting school technology ultimately means protecting the pupils, staff and communities who rely upon it every day.
Need advice or support?
If your school has concerns about the latest cybersecurity warning, or would like to review its wider IT security arrangements, contact the One Education IT Service.
Further information: National Cyber Security Centre – Critical Security Issue Affecting PHP
About the author
Mark Seddon is Director of IT & Business Development at One Education, supporting schools and multi-academy trusts with their technology, IT services and digital development needs
Please complete the form below and we will get in contact as soon as we can to help you with your query.
