On Wednesday 21 October 2026, Learning on Screen responded to two serious security vulnerabilities affecting PHP, a programming language used across many websites and applications, including some of our own services. We implemented immediate protective measures by 13:00 that day and applied security patches over the following days.
Our monitoring and review of security logs have found no evidence of unauthorised access to member information or archive data. There is currently no action required from members or their users.
What happened?
On 21 October 2026, two critical security vulnerabilities affecting PHP were publicly disclosed. Known collectively as PHP2Shell, the vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
PHP is a widely used programming language that powers many websites and applications, including WordPress and parts of Learning on Screen’s Box of Broadcasts (BoB) and TRILT services.
The vulnerabilities had the potential to allow attackers to execute unauthorised commands on affected systems, creating a risk to the information and services they support.
The vulnerabilities had initially been reported privately to the PHP security team by several research teams, allowing work on security patches to begin. However, details of the vulnerabilities became public before the planned release, increasing the urgency for organisations using affected versions of PHP.
The early publication of patched software also created opportunities for attackers to examine the fixes before they were widely available. Amazon’s threat researchers subsequently reported indications that exploitation attempts may have begun before the official disclosure.
For Learning on Screen, this meant acting quickly to assess the potential impact on our services and introduce protections while the relevant security updates became available.
Which Learning on Screen services were affected?
Two areas of our public-facing infrastructure were potentially exposed to these vulnerabilities:
- Our website, which uses WordPress and PHP 8.4.
- BoB and TRILT, which use PHP 7.4 as part of their underlying technology.
We take a layered approach to protecting our services and the information they hold.
BoB retains the personal information necessary to provide the service, including user names, email addresses, institutional affiliations and account identifiers. It also holds operational information such as off-air requests and viewing history. Passwords for users who do not access the service through single sign-on (SSO) are stored using industry-standard hashing.
Additional protections are in place to separate sensitive information and archive content from public-facing systems. Access to our broadcast archive is controlled, and our internal applications have additional access restrictions.
These safeguards form part of our wider approach to information security, although no single security measure can eliminate risk entirely.
How we responded
Our Digital team became aware of the vulnerabilities early on Wednesday 21 October and immediately began assessing the potential implications for our services.
As technical information became available, the team identified two protective measures that could be implemented ahead of the official security patches:
- Introducing additional Web Application Firewall (WAF) protections to identify and block suspected exploitation attempts.
- Disabling the PHP functionality associated with the identified vulnerabilities.
Both measures were deployed immediately, and by 13:00 on Wednesday 21 October, the mitigations were in place across our affected systems.
Our review of security logs found no evidence of attacks against our systems before these protections were introduced. Subsequent monitoring showed the firewall protections blocking attempted attacks.
Once the PHP project released security patches for supported versions, our team began applying them across affected services.
Timeline of our response
Wednesday 21 October
Our Digital team assessed the vulnerabilities and implemented immediate protective measures by 13:00. Monitoring continued while the official patches were being released.
Thursday 22 October
By 14:00, most affected systems had been updated with the relevant security patches.
Monday 26 October
A further security update was deployed to the BoB systems running older versions of PHP. As some of these versions are no longer officially supported, the update required a specially adapted patch developed by Ondřej Surý, who maintains PHP packages widely used across Linux systems, alongside additional work by our Digital team.
At the time of writing, a small number of further updates, affecting Search, some custom institutional applications and an internal back-end system, remain in testing. These systems do not have access to user or archive data.
Throughout this period, we have continued monitoring our services for signs of attempted exploitation.
While our monitoring has identified attempted attacks, predominantly directed at our WordPress installation, our security protections have blocked these attempts. Our review of the available logs has found no evidence of unauthorised access to member information or archive content.
What does this mean for members?
We recognise the importance of protecting the information that members and their users entrust to Learning on Screen.
Our investigation to date has found no evidence that member information or BoB archive data was accessed without authorisation as a result of these vulnerabilities.
This is an important distinction: while our monitoring and investigation provide reassurance that the protective measures have been effective, we cannot claim with absolute certainty that no unauthorised activity occurred.
Based on the evidence available, there is currently no need for members or their users to take any action.
In particular, we are not advising users to change their passwords in response to this incident. Passwords held by Learning on Screen are stored using industry-standard hashing, and users who access BoB through OpenAthens or another single sign-on provider do not have a password stored with us.
We will continue monitoring our systems and reviewing any further information relating to these vulnerabilities.
Our ongoing security priorities
This incident has reinforced the importance of our continuing programme of infrastructure modernisation and security improvements.
Over the past 18 months, Learning on Screen has made significant improvements to its technical infrastructure, including our migration to Amazon Web Services (AWS). These changes have strengthened our ability to identify, respond to and mitigate emerging security threats.
Some of our applications have been developed and maintained over many years, and updating them requires careful planning to maintain service continuity and reliability.
Modernising these systems is already part of our technical roadmap, and this incident has reinforced the priority of that work.
Over the coming months, our Digital team will focus on:
- Completing outstanding security updates and continuing to monitor affected services.
- Progressing the modernisation of older applications, including BoB.
- Improving consistency across our technical infrastructure and supported software versions.
- Continuing to strengthen our operational security and ability to respond rapidly to emerging threats.
We will provide further updates on this work as appropriate.
Do members need to do anything?
No action is currently required.
Our review of security logs has found no evidence of unauthorised access to member information or archive data, and we are not recommending any changes to user accounts or passwords.
If your institution requires further information for its own security records or internal reporting, please contact our support team at support@learningonscreen.ac.uk.
We take our responsibility to protect member information seriously and remain committed to communicating transparently about security matters and the steps we take to safeguard our services.
More information
For members and IT teams who would like to understand the wider PHP2Shell vulnerabilities and their disclosure in more detail, the following resources provide additional technical background:
- PHP2Shell vulnerabilities patched (Help Net Security): a summary of the vulnerabilities and patched PHP versions.
- PHP issues emergency patches for two critical PHP2Shell RCE flaws (The Hacker News): the disclosure timeline and official mitigation advice.
- Botched PHP2Shell disclosure revealed as panic continues (Computer Weekly): background on the disclosure and early signs of exploitation.
- AI found a critical PHP flaw. The bigger failure began in 2024. (The New Stack): background on the vulnerabilities and the disclosure process.
- The volunteer who patched PHP 5.6 through 8.5 (HeroDevs): the development of security fixes for older PHP versions.
- PHP2Shell: detection, analysis, and remediation (Datadog Security Labs): a technical analysis for security teams.