October 2026

As you may be aware from reports on national news, on 21 October 2026, two critical security vulnerabilities were announced affecting PHP, a technology used by many web-based platforms worldwide.

These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could potentially allow attackers to gain unauthorised access to affected systems that had not been patched.

Our teams were aware of the vulnerabilities and were prepared and had developed a plan to mitigate impact ahead of time.

We want to explain how this affected Evidence for Learning and the steps we took to protect our customers’ data.

How was Evidence for Learning affected?

Some Evidence for Learning services use PHP and therefore required security updates.

What steps were taken?

The PHP services were patched and verified immediately on 21st October. 

Two of the PHP services depended on security updates from Amazon Web Services (AWS), which were not immediately available.

As a precaution, we temporarily suspended these two services until the necessary patches became available and had been successfully applied and verified.

To minimise downtime and disruption, whilst waiting for the AWS security updates, our team developed and put in place 2 new verified secure environments that were not dependent on those specific AWS security updates.

The Evidence for Learning platform was fully restored and operational in the early hours of 22 October, following completion of these updates.

Safeguarding measures & security checks

Our team carried out comprehensive and rigorous checks including a detailed analysis of security, firewall and web server logs across all of our systems and found NO evidence of unauthorised access to our systems or our customers’ data.

To confirm neither Evidence for Learning systems nor any schools’ data were affected or compromised.

Protecting our customers’ data is our highest priority, we have robust and extensive systems in place continuously logging, monitoring and protecting the Evidence for Learning infrastructure and environments and your data.

If you have any questions, or your privacy or information security team would like more detail, please contact services@theteachercloud.net

Thank you again for your continued support.