PHP Security Vulnerability Update
The PHP security vulnerability detected on 21st October may have applied to around 70% of websites globally and many were taken down for a short period of time while the patch was applied. Further information can be found on the NCSC website here.
A fix was released later in the afternoon of the same day, which allows providers to patch their systems and close this vulnerability.
What Computeam has done
We can confirm that Computeam patched and updated all affected systems that we operate within hours of the fix being released. This includes our website (computeam.co.uk), our client support portal, the Learning Locker learning platform and the Compass digital standards platform. We have also reviewed the systems we manage on clients behalf, applied the update wherever PHP is in use, and checked them for signs of compromise.
However, many of the systems schools use, such as MIS, payments, safeguarding, communications and website platforms, are hosted by their suppliers. Only those suppliers can apply the update and confirm that they have done so, so we are relying on them to provide that confirmation.
What we are doing next
Our team has been compiling a list of commonly used school systems, showing which suppliers have publicly confirmed their position, with a link to each supplier's statement. We have included the list below this post, and will continue to keep updating it, until further notice.
What we recommend you do
- If your school runs its own website or platform (for example WordPress or Moodle) that Computeam does not manage, check with whoever looks after it that it has been updated.
- Email your third-party suppliers (like parent communication portals, payment apps, and booking systems) to confirm their software is safe. If you are unsure, consider suspending their use until they confirm status, provided they are non-critical systems.
- Be cautious of unexpected emails asking you to "patch", log in or verify your details. Scammers often take advantage of news like this. If in doubt, contact us before acting.
- If a supplier tells you they have had, or suspect, a breach, contact your Data Protection Officer straight away, and let us know so we can support you with next steps.
How you can help
If you receive confirmation from any supplier, please forward it to support@computeam.co.uk so we can update the list for all our schools. If there is a specific service you are concerned about and the supplier has not responded, let us know and we will help you follow it up.
Supplier status
| Supplier / product | Status | Public statement |
|---|---|---|
| Arbor EducationArbor MIS | Patched | Arbor security notice |
| AtivionFormerly Impero Software; includes ContentKeeper | Mitigations applied | Ativion customer update |
| BromcomMIS, Finance, Vision and websites | Not affected / patched | Bromcom statement |
| CPOMSCPOMS safeguarding | Not affected | CPOMS statement (X) |
| InstructureCanvas LMS | Not affected | Instructure status page |
| Juniper EducationMIS, assessment, HR, payroll, websites, Pupil Asset | Patched | Juniper update |
| Lightspeed SystemsFiltering and safeguarding | Not affected / patched | Lightspeed status page |
| Moodle HQMoodle HQ-hosted sites (not self-hosted Moodle) | Patched | Moodle status page |
| NetSupportclassroom.cloud, NetSupport School, DNA, Manager, Notify | Not affected | NetSupport statement |
| ParentPay GroupSIMS, FMS, ParentPay, Schoolcomms and others | Not affected / patched | ParentPay Group statement |
| RenaissanceAccelerated Reader, Star Assessments, Nearpod, myON | Mitigations applied | Renaissance status page |
| Schools Advisory ServiceStaff absence insurance systems | Patched | SAS statement |
| SWGfLOnline safety services | Patched | SWGfL statement |
| WondeSchool data integration | Patched | Wonde Q&A (PDF) |
This list is based on suppliers' own public statements; we have not independently tested these systems. If your supplier is not listed, please ask them directly and forward their confirmation to support@computeam.co.uk so we can add it.
Posted on October 23rd 2026
Learning Locker
Climate project
Updating page...