PHP vulnerability
Last updateresolvedOct 22 · 19:28 UTC
This is our final status page update related to the PHP2SHELL vulnerability. Moodle has deployed the PHP security patches to all client sites we host to address the PHP2SHELL vulnerability. All Moodle client sites are online and operational at this time. Our security team’s investigation found no evidence that these vulnerabilities were exploited on Moodle hosted sites or that client data was accessed. No action is required by Moodle hosted clients. Thank you for your patience and understanding during this global security event. We will post further updates here only if there are material developments. If you would like to learn more about this vulnerability and event, we encourage you to read the advisories published by the PHP project and the following government agencies: PHP Security Advisory: Critical remote code execution vulnerabilities - https://www.php.net/archive/2026.php#2026-10-21-5) US Cybersecurity and Infrastructure Security Agency (CISA) - https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching CERT-EU Security Advisory - https://cert.europa.eu/publications/security-advisories/2026-018 Australian Cyber Security Centre - https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php
Reported by Moodle US on their status page.