White Rose Education: PHP security update
An update on the PHP security vulnerabilities identified on 21st October 2026, the actions we’ve taken and what this means for our users.
Following the disclosure of two PHP security vulnerabilities on 21st October 2026, White Rose Education promptly assessed its systems and took precautionary action to protect our services and users.
We can confirm that some White Rose Education systems were identified as potentially vulnerable. In response, we temporarily took affected public-facing services offline, applied the necessary security updates and completed testing before safely restoring access.
All required updates were completed on 21st October 2026, with affected public-facing services unavailable between approximately 15:45 and 19:30.
Our investigation has found no evidence that these vulnerabilities were exploited within White Rose Education systems or that any customer data was compromised.
We take the security of our systems and the protection of customer information extremely seriously. Our information security and privacy controls are independently audited against the internationally recognised ISO 27001 and ISO 27701 standards, with our most recent recertification completed in August 2026.
Response to Department for Education guidance
In line with the Department for Education’s guidance, we can confirm the following:
1. Have suppliers assessed whether any services used by the school or college were affected?
Yes. White Rose Education assessed its systems and identified that some were potentially vulnerable to CVE-2026-109618 and CVE-2026-109619.
2. Have all required security updates or patches been applied?
Yes. Once the vulnerability details and security patches became available, we restricted public access to affected services, applied the required updates and completed testing before safely restoring access on 21st October 2026.
3. Have suppliers reviewed relevant communications and security advisories?
Yes. White Rose Education reviewed the relevant guidance from the PHP Foundation and National Cyber Security Centre, alongside communications from relevant suppliers and partners, and implemented the recommended remediation measures.
What does this mean for White Rose Education users?
The necessary security updates have been applied, and affected services have been restored following testing.
Our investigation has found no evidence of unauthorised access or customer data being compromised as a result of these vulnerabilities.
We will continue to monitor our systems and follow relevant security guidance to maintain the security of our services and protect our users.
If you have further questions, or your privacy or information security team would like any more detail, please get in touch at dataprotection@whiterosemaths.com