Critical Security Updates needed to manage PHP2Shell
In this Article
What Moodle Site Owners Need to Know
Applications like WordPress, Drupal, Nextcloud and Moodle all rely on PHP.
PHP is a programming language that does much of its work behind the scenes. It’s the little elf in the cupboard that gets on with the job while we get on with using our websites and learning platforms.
On 21 October 2026, emergency security fixes were released for two critical PHP vulnerabilities, collectively known as PHP2Shell. These vulnerabilities could allow hackers to gain control of affected servers, potentially putting websites, learning platforms and the information they hold at risk.
If your organisation uses Moodle, there’s something you need to check, and fairly urgently too.
What does PHP actually do for Moodle?
When a learner opens Moodle, clicks on a course, submits an assignment or checks their feedback, their browser communicates with the server that hosts Moodle.
PHP helps Moodle process these requests, retrieve information from the database and build the pages the learner sees. All of this usually happens in a fraction of a second.
Moodle is written in PHP, but PHP is maintained separately as part of the server environment. Each requires its own updates.
This matters because a perfectly up-to-date Moodle installation could still be running on vulnerable PHP software. Updating Moodle itself won’t fix a security problem in PHP.
So, what went wrong?
Security researchers discovered two vulnerabilities in the way PHP manages computer memory.
One involves out-of-memory corruption, where PHP can mistakenly use improperly initialised information. The other involves stale global state, where a later request can access information after the memory holding it has been released.
Researchers identified exploitable paths in August 2026. Following coordinated investigations and an early information leak, PHP released emergency fixes on 21 October. Under certain conditions, hackers can exploit these flaws to execute commands remotely, without logging in. This is called unauthenticated remote code execution, or RCE.
What we did at Limina
Once the PHP flaw was discovered, Nico, our Head of Tech, began monitoring developments and preparing for the security updates. As soon as the patch was released, early on 22 October, the tech team deployed PHP 8.3.36. By 08:30, all our managed servers, including our clients’ servers, had been updated.
At 09:00, we emailed our clients, explaining what had happened, what we’d done and whom to contact with questions or concerns.
Meanwhile, Nico continued monitoring server activity, Moodle operations and the WordPress sites we manage. At the time of writing, our checks have revealed nothing suspicious associated with PHP2Shell.
For most clients, the day continued as usual. Learning could carry on while the technical work happened quietly in the background.
How do you fix PHP2Shell?
The PHP Project released four patched versions: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Here’s what your technical team needs to do:
Check your PHP version
Find out which version your server is running and whether it's compatible with your Moodle installation.
Install the security fixes
Update PHP to the appropriate patched version, ensuring that both PHP2Shell vulnerabilities have been addressed. Some hosting environments use vendor-specific security patches with different version numbers.
Restart and verify
Restart the affected PHP services and confirm that the running system is actually using the patched software.
Check for suspicious activity
Review server and security logs for signs of attempted or successful attacks. Patching addresses the vulnerabilities, while checking the logs helps establish whether anything suspicious has already happened.
Test your Moodle site
Check that everyday functions, including logins, submissions, quizzes, plugins and scheduled tasks, are working properly after the updates.
If immediate patching is impossible, your technical team may need to restrict public access temporarily while they work on a solution.
Just a note: Different Moodle releases support different PHP versions, which can complicate patching.
- Moodle 4.5 LTS supports PHP 8.1 through 8.3, making patched PHP 8.3.36 a compatible option.
- Moodle 4.1 LTS supports PHP only up to 8.1, for which PHP no longer publishes security releases. Some operating-system vendors provide verified security fixes for older PHP versions, although Moodle 4.1 itself has reached the end of security support.
Some organisations therefore need to coordinate PHP patching with a broader Moodle upgrade. Updating Moodle alone does not fix the vulnerability in PHP.
Three questions every Moodle site owner should ask
If someone else manages your Moodle site, how confident are you that they’ve addressed the PHP2Shell vulnerabilities?
Contact your IT team or hosting provider and ask them these three questions:
- Who maintains the server environment? Who handles PHP, server updates and security?
- Have the security fixes been installed? Can your provider confirm both PHP2Shell vulnerabilities have been addressed?
- Have the running systems been checked? Has someone investigated suspicious activity or signs of compromise?
Should we take this seriously?
Moodle HQ certainly did. Following the announcement, Moodle HQ temporarily took its public-facing sites offline while its technical teams installed and verified the security fixes. It also urged organisations hosting their own Moodle sites to arrange urgent PHP patching.
Higher education institutions like the University of Helsinki and Munich University of Applied Sciences took similar precautions, temporarily interrupting Moodle and other online services.
Anyone managing a learning platform knows how disruptive such interruptions can be, particularly when learners are completing assessments or preparing for examinations.
These organisations considered the potential risks serious enough to interrupt services while securing their systems.
The good news is that no exploitation attempts had been reported up until 22 October 2026. We found no substantiated reports of a successful compromise of a named Moodle institution. So while precautions are necessary, installing the PHP patches should do the trick.
Need a hand?
Whether you’re fluent in Tech-speak or fluent in I-just-want-Moodle-to-work, we’re happy to help!
Book a free 30-min consultation with our team to hear how you can become a Limina client so next time, work can continue seamlessly for you too!
Book a free 30-min consultation.
Limina is a certified Moodle Partner, and one of only six companies worldwide certified to offer the MEQ and MAQ qualifications.
We make Moodle work so you can reimagine learning and truly impact each student’s life in a meaningful and lasting way.
Dr Isabel Tarling – CEO
Isabel Tarling is a learning sciences scholar, programme designer and education researcher, with a PhD from the University of Cape Town. Her research in online and technology-supported learning forms the foundation for much of her writing. She aims to build easy-to-understand bridges between evidence-based research and its everyday application in real-world contexts. Isabel is the founder of Limina, where these ideas are put to work to reimagine learning for organisations of all shapes and sizes.
Research has a habit of getting stuck between the pages of journals and books, or somewhere between academic language and everyday practice. Our blogs help get those ideas moving. We dig into the research, unpack complicated ideas and work out what they mean for people who design, support and care about learning. Then we draw out useful principles, processes and strategies that can travel into practice, across all the wonderfully varied places and ways in which learning happens.