Status

October 21, 2026: Preventive shutdown of the learning platforms due to a critical PHP security vulnerability

2:30 p.m. – Shutdown of all systems

Two critical security vulnerabilities have been discovered in PHP, the technical foundation of Moodle (CVE-2026-109618, CVE-2026-109619). These vulnerabilities affect PHP worldwide and do not specifically target Moodle or eLeDia. As a precaution, we have therefore taken all customer platforms offline. All data will be preserved.

The PHP project will release the security update today at 4:00 p.m. After that, we will install it, test the systems, and gradually bring the platforms back online.

4:46 p.m. – Update: The PHP security update has been released. The rollout is beginning on all platforms. The first platforms are expected to be back online as early as 5:30 p.m.

6:03 p.m. – 60% of the systems are back online. The rollout of the security patches is progressing. Many systems are already back online. Applying the patch and restarting the system takes longer, especially for larger systems. We are also preparing to apply the patch to the on-premises platforms we have set up.

8:30 p.m. – 99% of the systems are back online. We were able to roll out the security patch on all servers. For on-premises installations or systems with special configurations, the rollout may continue throughout the evening. We are in direct contact with the affected customers.