I’ve received an email from the Department for Education asking me to get assurance from my suppliers. Can you confirm where Secure Schools stands?
Yes. We can confirm that we have assessed our systems, applied the relevant security updates and reviewed the supplier communications and security advisories for this issue. The answers below give more detail, and you’re welcome to use them for your records.
Is this the PHP vulnerability?
Yes. The issue relates to a recently disclosed security vulnerability in PHP, a widely used open-source programming language that powers a large share of the web, including parts of our platform. Issues like this can affect many organisations at once, and the PHP community released a fix quickly.
Have you assessed whether the services my school uses are affected?
Yes. As soon as the vulnerability was disclosed on 21 October 2026, our team assessed our systems, websites and hosting environments. As a precaution, we took our services offline at 12.58pm BST while we completed this assessment. Our thorough checks found no evidence that our systems, or any school or customer data, were affected.
Have the required security updates been applied?
Yes. We applied the security update across our systems before bringing any service back online, so no service was available without it at any point. All services were fully restored by 10.45am BST on 22 October 2026 and are running as normal.
Have you reviewed the supplier communications and security advisories for this issue?
Yes. Our team has reviewed the PHP security advisory and the NCSC guidance and acted on them. We continue to monitor our systems closely as part of our usual security practice.
Is any work still outstanding?
No. No remediation remains outstanding, and all services are running as normal with the update applied.
If you require any further information please review our statement and FAQs here or email support@secureschools.com