PHP vulnerability status

Area of highest risk. Only 23 sites use PHP, so most of the estate is not directly affected. However, the vulnerability allows remote code execution, with a risk of movement across the estate. Containment is under way and PHP sites are being patched; breaking changes from upgrades are slowing the rollout.

Contained and mitigated. Patch manually applied to an older operating system via a custom-built image, with firewall rules in place. This remains open as it is a bespoke solution; we are monitoring to verify the vulnerability is closed.

WPEngine has deployed fixes across the estate. TPJ proprietary plugins have been patched and distributed. Third-party plugins will update automatically via Plugin Manager once providers release fixes; plugins are not affected by the attack vector.

Patched and deployed on 21 October. Peripheral services (Moodle, Videoettes, Engage) are listed separately.

Updates have been rolled out and these services are now patched. No action required.

Patched on the evening of 21 October, including all Guild websites. No action required. This corrects our earlier update, which showed patching as still in progress.

Patched. No action required.

This software does not use PHP. However, Reapit requires confirmation by 19:00 today (22/10/2026) that any compromise is contained. Street has disabled the integration; it is unclear whether they are impacted, though their software is written in PHP. We will confirm today that this area is not impacted.

No action required.

No action required.

No action required.

No action required.