On 20 October, the PHP project announced two critical security vulnerabilities (both rated CVSS 9.2) affecting all versions of PHP. The official notice is available at https://www.php.net/archive/2026.php#2026-10-20-1. A fix is scheduled for release today, 21 October, at 16:00 CEST. Many organisations are taking PHP-based websites offline until then as a precaution, which has led to questions from several of our customers.
We have investigated the impact on our platform. Our applications do not run on PHP and are not affected by these vulnerabilities. Your data and your learners’ data are not at risk through our applications. No action is required on your side for these products.
Our own website drieam.com has been taken offline temporarily as a precaution. This has no effect on any of our applications.
Specifically for Eduframe customers using the WordPress plugin or Drupal module
The Eduframe WordPress plugin and the Eduframe Drupal module are the only places where we use PHP. These run on your own website, not on our infrastructure, so the exposure depends on your own hosting setup. If you use one of these, we recommend you follow the advice of your hosting provider or web agency for the PHP vulnerability itself. Once the PHP fix is released, we will check whether the plugin and module need an update and inform you here if any action is needed on your side.
We will update this page as soon as there is news.
