PHP vulnerability "PHP2Shell" (October 2026): FeedbackFruits is not affected, and what to do if your LMS runs PHP

• FeedbackFruits does not run PHP in production. We assessed both vulnerabilities and they do not apply to our systems.

• Systems your institution runs on PHP, such as Moodle, may be exposed until they are patched.

• If you use Moodle, apply the patch following the PHP security advisory and/or contact your Moodle support for advice.

What happened
On 20 October 2026, the PHP project announced two critical vulnerabilities in the PHP interpreter itself, CVE-2026-109618 and CVE-2026-109619, together known as "PHP2Shell". Patched PHP releases followed on 21 October. The vulnerabilities allow remote code execution over HTTP, so a website running on an unpatched PHP version can be at risk even without any bug in the application itself.

Is FeedbackFruits affected?
To be precise about scope: this is a vulnerability in PHP, not in FeedbackFruits. We do not use PHP in our production environments. We assessed both CVEs and concluded they are not applicable to FeedbackFruits-hosted systems, so no patching was needed on our side.

Possible impact for Moodle users
Moodle is built on PHP. A Moodle site that has not been patched could potentially be taken over, and a compromised LMS could potentially be used to gain unauthorized access to systems connected to it, including its integration with FeedbackFruits.

What action is needed?
If your institution runs Moodle, or another PHP-based system connected to FeedbackFruits, please:

• Apply the patch, following the official PHP guidance on this vulnerability.

• Contact your Moodle support for advice specific to your setup.