PHP vulnerability

Incident Report for Moodle US

Resolved

This is our final status page update related to the PHP2SHELL vulnerability. Moodle has deployed the PHP security patches to all client sites we host to address the PHP2SHELL vulnerability. All Moodle client sites are online and operational at this time.

Our security team’s investigation found no evidence that these vulnerabilities were exploited on Moodle hosted sites or that client data was accessed. No action is required by Moodle hosted clients.

Thank you for your patience and understanding during this global security event. We will post further updates here only if there are material developments.

If you would like to learn more about this vulnerability and event, we encourage you to read the advisories published by the PHP project and the following government agencies:

PHP Security Advisory: Critical remote code execution vulnerabilities - https://www.php.net/archive/2026.php#2026-10-21-5)
US Cybersecurity and Infrastructure Security Agency (CISA) - https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
CERT-EU Security Advisory - https://cert.europa.eu/publications/security-advisories/2026-018
Australian Cyber Security Centre - https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php

Posted Oct 22, 2026 - 19:28 UTC

Monitoring

Patches have been issued to address this vulnerability. We are applying these patches to sites and will bring sites online as soon as they have been patched and verified. We do not have a clear timeframe of when the full set of patches will be completed, but we are working quickly and carefully to update your site and get it back online.

If you would like more information on this situation, please visit the CERT-EU Security Advisory page for an overview on the source of this vulnerability affecting sites around the world. https://cert.europa.eu/publications/security-advisories/2026-018

Posted Oct 21, 2026 - 22:05 UTC

Update

We are continuing to work on a fix for this issue.

Posted Oct 21, 2026 - 20:13 UTC

Identified

As a proactive response to the PHP2SHELL vulnerability, which was made public on October 21, 2026, and in line with the recommendations from CERT-EU and the Australian Cyber Security Centre (ACSC), Moodle has begun taking sites offline. We will keep sites offline and will restore access once we have applied and verified the recently released, necessary security patches.

We encourage self-hosted site holders to notify the individual(s) responsible for updating PHP for their sites and to create a plan to update your PHP with the released security patches. We are preparing a fuller response that addresses this vulnerability and the steps we are taking. We want that update to be accurate and substantive, not reactive, so we are taking a short time to confirm the relevant facts internally before responding in full.

Posted Oct 21, 2026 - 15:47 UTC

This incident affected: Moonami Client Infrastructure (Shared Moodle Hosting), unHosting Client Infrastructure (unHosting Control Panel, unHosting Sites on AWS Cloud Infrastructure), and eLearning Experts Moodle Hosting.