4:46 p.m. – Update: The PHP security update has been released. The rollout is beginning on all platforms. The first platforms are expected to be back online as early as 5:30 p.m.
6:25 p.m. – Update: Most of our learning platforms are now fully accessible again. The security patch has been applied, and final tests are underway.
Today, Wednesday, October 21, 2026, we took all the learning platforms we manage offline as a precautionary measure starting at 2:30 p.m. This was due to two critical security vulnerabilities in PHP for which there is no update available yet. Your data will remain completely intact. We apologize for the inconvenience. We know how frustrating this is in the middle of our daily operations.
What happened?
Since Tuesday, October 20, 2026, two critical security vulnerabilities in PHP have been publicly known (CVE-2026-109618 and CVE-2026-109619). PHP is the programming language on which many web applications run, including Moodle. The vulnerabilities are inherent in PHP itself and affect everyone who uses PHP worldwide. They are neither a bug in Moodle nor the result of an incident on our end.
The sequence of events is unusual. Typically, details about a security vulnerability aren't made public until an update is available. This time, however, the details were made public before the PHP project could release an update. This means anyone can learn about the vulnerabilities and exploit them deliberately while there is still no protection in place.
Why offline?
The PHP project announced the security update for this afternoon. Until we have installed it, we cannot reliably protect your learning platforms against these vulnerabilities. We did not want to take any risks with your data or that of your learners, so we have taken the learning platforms offline.
How We Make Decisions
We have a defined procedure for critical security alerts. It is part of our Information Security Management System (ISMS), which is certified to ISO/IEC 27001.
We evaluate every report based on established criteria. If we cannot rule out a risk to your data, predefined protective measures are implemented. The most far-reaching of these is taking learning platforms offline as a precautionary measure. A dedicated team of our Operations Experts manages every step, documents it, and reviews each Learning Management System before it goes back online. We then evaluate the process and improve it where necessary.
While we believed this morning that our existing measures were sufficient, following further internal testing, we have decided to take all systems offline, even before receiving approval from our customers.
What happens next?
As soon as the update is released, we’ll install it and gradually bring the learning platforms back online throughout the evening. According to our schedule, all learning platforms will be accessible again by this evening. You can check the current status at any time on our status page. If it takes longer for your Learning Management System , we’ll let you know right away.
What do you need to do?
You don't need to do anything. You don't need to change any passwords or adjust any settings. We have no indication that the vulnerabilities were exploited on our systems.
