Edu-Tech, K-12 Technology Partner
Resources

Website security

What to ask your website vendor after a critical web flaw

A school website can look fine while it needs a security update. Use these questions to find out who is responsible, what has been fixed, and what still needs attention. The October 2026 PHP flaws show why this matters.

The PHP2Shell example

On October 21, 2026, the PHP project released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. PHP runs many websites, including WordPress and Drupal sites. These flaws could let an attacker take control of an affected server without a password.

CISA's October 21 alert and the FBI's October 23 notice urged organizations to patch internet-facing systems. As of October 23, CISA said it knew of no successful break-ins using these flaws. That was a statement about what was known on that date, not a reason to leave an affected site unpatched.

The fixed releases were PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older received no fix. PHP 8.2's security support ends December 31, 2026, so schools using it also need an upgrade plan.

Start with a list of your school's sites

Your main website provider may manage security updates for you. Ask rather than assume, and include sites run by other departments or vendors:

  • The main school website, including any WordPress or Drupal installations
  • Camp, athletics, alumni and event sites
  • Admissions, giving and registration forms hosted separately
  • Tools the school hosts itself, such as Moodle, a help desk or an inventory system
  • Old sites that are still publicly reachable

A site that loads normally may still need a security update. Ask the person responsible to confirm its status in writing.

Questions to ask after a critical flaw

  1. Which of our sites are affected, and who updates each one?

    Share your site list with each vendor. Ask them to name the sites they cover and identify anything outside their responsibility. Your technology lead, business office, admissions and athletics staff can help fill the gaps.

  2. What was fixed, and when? Please confirm in writing.

    Ask for the installed version and patch date for each affected site. For PHP2Shell, the vendor should confirm a fixed release or a later supported version, or explain why the site is not affected. Also ask how quickly they apply critical updates after future alerts.

  3. Does any software no longer receive security fixes?

    Ask for an upgrade date, not just a promise to monitor it. PHP 8.1 and older received no PHP2Shell fix; PHP 8.2 stops receiving security fixes after December 31, 2026.

  4. What happens if a site cannot be patched promptly?

    Agree who can take it offline, who will arrange the fix, and how parents will hear about any disruption. Ask whether the vendor checked for signs of compromise; installing a patch does not establish that a site was never accessed.

Keep a short written record

  • The list of sites and the person or company responsible for each
  • Vendor confirmations, installed versions and patch dates
  • Any unresolved issue, its owner, the agreed protection or shutdown decision, and the deadline for a fix

Keep these with your security records so your leadership team, board or insurer can see what was checked and what remains open.

Make the next alert easier to handle

Keep the site list current when a department launches a new service or changes vendors. Include patch responsibilities and response times in vendor reviews.

Your school's computer monitoring may not cover a website hosted by someone else. Confirm that website security has an owner rather than assuming it is included in another service.

A request you can send your website vendor

Copy this, fill in the brackets, and send it to each company or person who hosts or manages a site for your school. For another security alert, replace the PHP example with that alert's details.

Subject: Written confirmation requested: website security updates

Hello [name],

We are checking our school's websites following the October 2026 PHP2Shell alert (CVE-2026-109618 and CVE-2026-109619).

For each website or system you host or manage for [school name], please confirm in writing:

1. Which sites you cover and whether they use an affected version of PHP. 2. The installed PHP version and the date the fix was applied, or why the site is not affected. The fixed releases were 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 3. Any site still awaiting a fix, what protects it in the meantime, and the deadline for patching or taking it offline. 4. Any software that no longer receives security fixes, and the plan to replace or upgrade it. PHP 8.1 and older received no fix; PHP 8.2 security support ends December 31, 2026. 5. Whether you have checked for signs of compromise, and how quickly you apply critical security updates.

Please reply by [date]. We are keeping your confirmation with our security records. Thank you for your help.

[Your name] [Title], [school name]

Not sure which sites your school has?

We can help you make the list and work out what to ask each vendor. Start with a 15-minute conversation, with no obligation.

Book a 15-minute call (opens in a new tab)Take the 5-question self-assessment

Sources