On 21 October a critical security flaw was announced in PHP, the software WordPress and millions of other websites run on. We installed the fix on every website and system we host for schools the same day, and we found no evidence that any school’s website or data was affected. You don’t need to do anything.

What happened

The PHP project released fixes for two related flaws (CVE-2026-109618 and CVE-2026-109619, sometimes called “php2shell”). In some circumstances they could let an attacker run their own code on a web server without logging in. They affected almost every organisation that runs PHP, not Realsmart in particular.

What we did

  • Prepared before the fix arrived. We identified every system we run that uses PHP, so we were ready the moment the fix was released.
  • Added protection within the hour. We switched off the part of PHP one of the flaws could be reached through, on every system.
  • Installed the fix the same day. Every Realsmart-hosted website and system was running the fixed version by 7pm, and we checked each one.
  • Removed what wasn’t needed. We took PHP off systems that didn’t use it, and every new server we start now begins with the fixed version.

Websites stayed available throughout.

What we found

We reviewed every server we run for schools, back to the day news of the flaws first appeared. We saw the routine automated scanning every website on the internet receives, and all of it was rejected. We found no evidence that the flaws were used against us, and no sign that any school’s website or personal data was affected.

What you need to do

Nothing. Your website, logins and content are unchanged. If your website runs on Smartpress, staff who sign in will also see a short notice about this on their dashboard until 4 November.

For your data protection officer

We’ve written a short statement for data protection officers, with a timeline of what we did, how we checked, and what it means under UK GDPR. You’re welcome to keep it with your records.

Download the statement for data protection officers (PDF, 72 KB)

If you have any questions, email support@realsmart.co.uk.