Cyber Resilience in Schools: Why the Latest PHP Vulnerability Should Be a Wake-Up Call

Steve Cullen

4 days ago

7 min read

The National Cyber Security Centre has issued an urgent warning about serious vulnerabilities in widely used web technology. For schools and academies, the message goes far beyond installing a software update. Cyber resilience must be part of everyday school management, safeguarding and information governance.

A serious warning for organisations across the UK

On 21 October 2026, the UK's National Cyber Security Centre (NCSC) published an alert concerning critical security vulnerabilities affecting PHP, a widely used programming language that supports websites, online applications and other digital services.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could, under certain conditions, allow attackers to execute malicious commands remotely on affected web servers without needing to authenticate. Security fixes have been released, and the NCSC is encouraging organisations using PHP to update to a fixed, supported version as a priority.

For schools, this is a timely reminder that cyber threats are not confined to suspicious emails, stolen laptops or ransomware. Sometimes, a serious security weakness exists within the underlying software on which an organisation depends. And that software may not even be something the school knows it is using.

What is PHP, and why should schools be concerned?

PHP is a programming language used behind the scenes by many websites and online systems. It processes information, communicates with databases and helps deliver interactive online services.

A school may encounter PHP through its website, an online learning platform, a web-based administrative system or a service provided by an external supplier. The school does not necessarily need to operate its own web server to be exposed to a vulnerability. An externally hosted service may depend on affected software. This creates an important distinction: the school may not control the technology, but it still needs assurance that the organisations providing its services are managing security risks appropriately.

A successful cyberattack against a school or its suppliers could potentially result in:

Unauthorised access to pupil, parent or staff information.
Disruption to attendance, assessment and administrative systems.
Loss of access to safeguarding or special educational needs records.
Interruption to teaching and online learning.
Financial losses, recovery costs and reputational damage.
Personal data breaches requiring investigation and potentially notification to the Information Commissioner's Office (ICO).

These are possible consequences of cyber incidents generally, not confirmed outcomes of the latest PHP vulnerabilities.

What does the NCSC recommend?

The NCSC's warning is practical and urgent. Organisations should identify where PHP is used, prioritise internet-facing systems, apply the relevant security updates and monitor for suspicious activity. Where a vulnerable system cannot be secured promptly, taking it temporarily offline may be necessary until the risk can be properly addressed.

For schools and academies, the immediate response should be to contact internal IT teams, managed service providers and relevant software suppliers. School leaders should seek confirmation that the vulnerability has been assessed and, where applicable, appropriately addressed. Simply assuming that an outsourced IT provider is dealing with the issue is not sufficient assurance.

The NCSC's full alert is available here: Critical security issue affecting PHP.

Cyber security is a governance responsibility, not just an IT problem

One of the most persistent weaknesses in organisational cyber resilience is the assumption that cyber security belongs exclusively to the IT department. Technical specialists are essential, but responsibility for organisational risk rests with school leadership and, ultimately, the relevant governing body or academy trust.

The Department for Education (DfE) makes this clear in its Meeting digital and technology standards in schools and colleges guidance, updated in September 2026. The guidance expects schools to have appropriate cyber security measures, maintain a cyber response plan, identify risks and report significant concerns through governance arrangements.

It also recommends annual cyber risk assessments, revisited each term and following significant changes or incidents.

A headteacher or governing body does not need to understand the technical workings of PHP. However, they should be able to establish whether the school has appropriate arrangements to identify vulnerabilities, respond to incidents and restore essential services.

The UK GDPR implications: security is a legal obligation

Cyber resilience is also fundamental to compliance with the UK General Data Protection Regulation and the Data Protection Act 2018. Article 5(1)(f) of the UK GDPR establishes the principle of integrity and confidentiality. Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage.

Article 32 requires controllers and processors to implement appropriate technical and organisational measures, taking account of the risks, available technology, implementation costs and nature of the processing. These measures can include encryption, ensuring the continuing confidentiality, integrity, availability and resilience of systems, restoring access following an incident and regularly testing security measures.

For schools, this is particularly significant because they routinely process children's personal information, safeguarding records, health information, SEND records, employment information and financial details.

The Information Commissioner's Office (ICO) expects organisations to adopt security measures appropriate to their particular risks.

A school that has reasonable security measures, keeps systems updated, supervises its suppliers and responds promptly to emerging vulnerabilities is in a considerably stronger compliance position than one that has no meaningful oversight. However, compliance is not established simply by having policies on paper. Schools need to demonstrate that their arrangements actually work.

Six practical priorities for every school

1. Know which systems you depend upon

Maintain an accurate inventory of essential software, hardware, online services and suppliers. This should identify who is responsible for security, maintenance, updates and incident notification. Schools should pay particular attention to systems containing sensitive personal information and those supporting essential operations.

2. Establish effective patch management

Security updates should be identified, assessed and installed promptly, with urgent vulnerabilities receiving priority. Schools should agree clear expectations with IT providers about how quickly critical security issues will be addressed. Unsupported software should be replaced, upgraded or subject to appropriate risk mitigation.

3. Strengthen access controls

Use multi-factor authentication where appropriate, restrict administrative privileges and ensure staff only have access to the systems and information necessary for their roles.

Review accounts when staff leave or change responsibilities.

4. Maintain secure and tested backups

Backups are essential, but their existence alone does not guarantee recovery. The DfE recommends maintaining three copies of important data across at least two separate devices, with one copy off-site, and using immutable backups to protect against alteration.

It also recommends testing and recording backup restoration at least termly.

Schools should know how quickly they could restore attendance, safeguarding, finance and teaching systems after an attack.

5. Prepare for an incident before it happens

Every school should have a documented cyber incident response plan, integrated with its business continuity and emergency arrangements. The plan should identify decision-makers, IT contacts, escalation procedures, alternative working arrangements and communication responsibilities. Consider what would happen if the school's management information system, email service or safeguarding platform suddenly became unavailable.

Could the school continue operating safely?

6. Train staff and maintain awareness

Cyber resilience depends on people as well as technology. All staff should understand how to recognise suspicious activity, report concerns and avoid actions that expose school systems or personal information to unnecessary risk. Training should cover phishing, password security, social engineering, unauthorised access, suspicious attachments and the reporting of potential data breaches. Governors and trustees also need sufficient awareness to challenge and support school leaders.

When a cyber incident becomes a personal data breach

Not every attempted cyberattack or software vulnerability is automatically a personal data breach. However, where an incident results in the loss, alteration, unauthorised disclosure of, or unauthorised access to personal data, the school must assess its obligations under the UK GDPR. Under Article 33, a personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals' rights and freedoms.

Where there is a high risk to individuals, Article 34 may also require the school to inform those affected without undue delay. Importantly, all personal data breaches must be documented internally, including those that do not meet the ICO reporting threshold.

Schools should involve their Data Protection Officer promptly when an incident may affect personal information.

For Insight MSIG clients, the Information Governance Master Record provides a practical means of recording incidents, decisions, risk assessments, actions taken and outcomes.

This evidence can be invaluable when demonstrating that a school has responded responsibly and proportionately.

Don't forget the suppliers

The latest PHP warning also raises an important question about third-party accountability.

Many schools rely heavily on external providers for websites, learning platforms, cloud storage, finance applications and administrative systems. Under Article 28 of the UK GDPR, schools must ensure that processors provide sufficient guarantees of appropriate technical and organisational measures. Contracts should address security responsibilities, assistance with incidents and notification of personal data breaches.

The ICO confirms that processors must notify controllers without undue delay when they become aware of a personal data breach.

Schools should therefore seek meaningful assurances from suppliers, particularly where systems process large volumes of pupil or sensitive information. An annual supplier review should not be regarded as a substitute for responding to an urgent security alert.

Resilience means being able to recover

Preventing cyberattacks is important, but no organisation can eliminate every risk.

True cyber resilience means being able to anticipate threats, withstand disruption, respond effectively and recover essential services.

For schools, this may mean maintaining secure access to essential safeguarding information when normal systems are unavailable, having alternative attendance procedures, preserving reliable communication with parents and ensuring teaching can continue safely.

The DfE's digital leadership and governance standards emphasise the importance of business continuity and disaster recovery planning.

These arrangements should be tested rather than simply filed away for an annual review.

A short tabletop exercise involving the headteacher, school business manager, safeguarding lead, IT provider and DPO can reveal weaknesses before a real incident occurs.

A final thought: cyber resilience is about protecting education

The PHP vulnerabilities are a serious technical issue, but they also provide an opportunity for schools to examine their wider preparedness. The question is not simply whether a particular software update has been installed. It is whether the school knows what technology it depends upon, understands the risks, can obtain reliable assurances from its suppliers and has practical arrangements to protect children, staff and essential services.

Cyber security is not an optional technical extra. It is an essential component of safeguarding, data protection, business continuity and responsible school governance.

The strongest schools are not necessarily those with the most expensive technology. They are those that understand their risks, take proportionate precautions and know what to do when something goes wrong.

The latest NCSC warning should encourage every school and academy trust to ask a simple question: If one of our critical systems was compromised tomorrow, how confident are we that we could protect our information, support our pupils and keep the school running? The answer deserves more than an assumption that somebody in IT has everything under control.