
PHP2Shell and Moodle LMS: Our Response and Your Next Steps
On October 21, 2026, PHP fixed two critical vulnerabilities, known as PHP2Shell, that can allow unauthenticated remote code execution. Every Moodle LMS site runs on PHP. We explain what we did for managed sites and what administrators should check.

