Thank you for your patience during this global security event. Patches for the PHP issues are beginning to be received, although there are several packages for each of the many versions of PHP that we run. We are actively updating all sites with the patches as they are ready but will not be restoring a service until that site is fully patched. We don't have a clear timeframe on when the full set of patches will be completed, but we are actively moving towards the goal. We will continue to provide updates as we make progress.
Posted Oct 21, 2026 - 18:02 UTC
Update
Open LMS has taken all customer sites offline as a preventative measure.
Why: Two critical zero-day vulnerabilities in PHP have been discovered and are being actively exploited. No mitigation is currently available, so taking sites offline is the only way to fully protect them. These vulnerabilities affect PHP-based websites worldwide and are not specific to Open LMS.
What's next: The PHP project expects to release patches today. As soon as they are available, we will apply them and bring sites back online.
What is happening: Open LMS is taking all customer sites offline within the next few minutes.
Why: Two critical zero-day vulnerabilities in PHP have been discovered and are being actively exploited. No mitigation is currently available, so taking sites offline is the only way to fully protect them. These vulnerabilities affect PHP-based websites worldwide and are not specific to Open LMS.
What's next: The PHP project expects to release patches today. As soon as they are available, we will apply them and bring sites back online.