Open LMS experienced a major incident on October 21, 2026 affecting Open LMS - Asia Pacific and Open LMS - Europe, Middle East & Africa and 1 more component, lasting 9h 11m. The incident has been resolved; the full update timeline is below.
Affected components
Update timeline
- identified Oct 21, 2026, 01:41 PM UTC
What is happening: Open LMS is taking all customer sites offline within the next few minutes. Why: Two critical zero-day vulnerabilities in PHP have been discovered and are being actively exploited. No mitigation is currently available, so taking sites offline is the only way to fully protect them. These vulnerabilities affect PHP-based websites worldwide and are not specific to Open LMS. What's next: The PHP project expects to release patches today. As soon as they are available, we will apply them and bring sites back online. openlms.zendesk.com/hc/en-us/articles/31214374861084
- identified Oct 21, 2026, 03:31 PM UTC
Open LMS has taken all customer sites offline as a preventative measure. Why: Two critical zero-day vulnerabilities in PHP have been discovered and are being actively exploited. No mitigation is currently available, so taking sites offline is the only way to fully protect them. These vulnerabilities affect PHP-based websites worldwide and are not specific to Open LMS. What's next: The PHP project expects to release patches today. As soon as they are available, we will apply them and bring sites back online. openlms.zendesk.com/hc/en-us/articles/31214374861084
- identified Oct 21, 2026, 06:02 PM UTC
Thank you for your patience during this global security event. Patches for the PHP issues are beginning to be received, although there are several packages for each of the many versions of PHP that we run. We are actively updating all sites with the patches as they are ready but will not be restoring a service until that site is fully patched. We don't have a clear timeframe on when the full set of patches will be completed, but we are actively moving towards the goal. We will continue to provide updates as we make progress.
- monitoring Oct 21, 2026, 08:01 PM UTC
Sites are coming back online. PHP security patches are now available, and we are installing them across our hosting environment. We have begun restoring sites as each one is fully patched, and we expect restoration to continue over the next several hours. What this means for you If your site is back online, it has been patched against both PHP vulnerabilities. If your site is still offline, it is in the queue. You don’t need to do anything. We’ll restore it as soon as its patches are installed. We’ll keep posting updates here as restoration progresses. Thank you for your continued patience.
- monitoring Oct 21, 2026, 10:40 PM UTC
The overwhelming majority of customer sites are now fully patched and back online. We are actively working on the remaining sites and expect to restore them within the next few hours. Thank you for your patience and understanding throughout today’s event.
- resolved Oct 21, 2026, 10:53 PM UTC
This incident has been resolved. Please contact support if you have further questions or issues.