We’re aware of two recently disclosed PHP security vulnerabilities:
-
CVE-2026-109618 — CVSS 9.2 (Critical)
-
CVE-2026-109619 — CVSS 9.2 (Critical)
The PHP environment supporting our schools’ websites has already been updated to a patched version that addresses both vulnerabilities. No action is required from schools.
Our team actively monitors, manages and maintains the website environment, including assessing security vulnerabilities and applying necessary updates. Schools do not need to contact us whenever security updates like these are announced—we’ll investigate and take appropriate action as part of our ongoing website management.
However, you’re always welcome to reach out if you have any questions or would like reassurance. We’re happy to confirm that your website environment is up to date.
Further technical information is available in the official PHP security announcement.
