Brief Overview
At 8:41am on the 21st October, a new major security flaw in a technology called PHP was leaked. PHP powers 70% of websites. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them. We use PHP at DBD Schools.
Our Response
The same day the leak was released, we were able to patch all of our public-facing servers. We are happy to confirm that we have not detected any unusual or malicious activity on our servers, or any signs of intrusions or leaks.
On the advice of the PHP Foundation, Police Cybercrime Unit, and National Cyber Security Centre, we took down our websites at 10:15pm for around 40 minutes while the servers were being upgraded. Servers were back online by 11pm.
We have a few internal processes which also rely on PHP. These were largely upgraded by the end of the following day.
Only 1 section of 1 of our websites couldn’t be upgraded in time; we shut down that part of that website and will put it back online once it can be secured. The school in question has been contacted directly.
Answers to DfE and LA questions
The DfE has sent a list of questions to schools, which in turn they have asked their web developers to answer. Additionally, many local authorities have questions. We believe this should answer your questions.
Please can you confirm that:
- You have assessed whether any services used by your school or college are affected.
- Yes
- Any required security updates or patches have been applied.
- Yes
- You have reviewed all relevant supplier communications and security advisories relating to this issue.
- Yes
Timeline
Time (UK/London time)
2024
A team of researchers discovered a bug in PHP. However, the issue was not addressed at the time as there were many trade-offs, and at the time it didn’t seem possible for humans to exploit the bug.
30th July 2026
A team of researchers, including OpenAI (who run ChatGPT), Calif and Wiz, used AI to find a way to exploit the bug to hack web servers.
11th August 2026
The PHP Foundation began to work on fixing the bug. Details of the bug were kept confidential.
The idea was to keep details confidential until a patch was ready and a release coordinated properly.
20th October
A patch had been made, and we were told the update would be available at 3pm on the 22nd October. The team at DBD Schools were aware and ready.
Calif, one of the firms that discovered the bug, accidentally published a video describing the bug.
The PHP Foundation made the decision to move the release 1 day earlier, to 3pm on Wednesday 21st October.
This was planned to be a coordinated disclosure with minimal impact.
21st October
The PHP Foundation disclosed details to large infrastructure providers and distributors around the world, so they could begin preparing for the release.
One of these companies, Chainguard, broke the agreement and released a patch to their customers 6 hours earlier than agreed.
This is largely why this escalated into such a large issue, because the extra time allowed hackers to develop tools to exploit the vulnerability before distributors could patch their products.
Many large companies, like Cloudflare, reported thousands of attacks trying to exploit the vulnerability.
This was about the time we became aware of the leak and started investigating.
The PHP Foundation released their patch. At DBD Schools we still had to wait until our infrastructure providers had a release ready before we could begin to apply it to our websites.
A little while later we saw reports of large organisations and governments shutting down their websites. Then the UK’s NCSC published its recommendation to shut down websites.
At this time, many schools were on half-term break. Even at schools that were in term, many school receptions were shut.
We began sending out emails to our schools advising of the issue and letting schools know we may need to take their websites offline.
Our infrastructure provider had prepared a release which we began implementing.
All our websites had been taken offline.
All our websites had been patched and made operational once again.
22nd October
The DfE sent out emails to schools making them aware of the issue and asking them to ensure websites were secured.
We had already informed schools long before this.
Why this was such a big deal
In the past, a patch would be released, and we would have a few days to apply the patch before hackers could build the tools to exploit the bug.
Take the Log4j vulnerability, for example. This was discovered in 2021. It took around 15 days after the vulnerability was disclosed before we saw large-scale attacks against the bug.
Hackers can now use AI to develop tools much more quickly. In this situation, it took less than 4 hours from the leak before attacks were being made.
If things went according to plan, the patch would’ve been released at 3pm and we would’ve had a few hours to apply the patch. Instead, the release by Chainguard gave hackers an additional 6-hour head start to start working on exploits.
Related content
Cyber security
How we protect school data, with Cyber Essentials Plus certification, external audits, Police CyberAlarm monitoring and annual training for all our staff.