Investigating - Critical PHP Vulnerabilities

Update timeline

1. investigating Oct 21, 2026, 04:32 PM UTC

   PowerSchool is aware of recently disclosed critical security vulnerabilities affecting PHP. Our Security and Engineering teams are actively assessing the potential impact across our products and implementing protective measures as appropriate. For PowerSchool-hosted environments, additional protections are being applied to help mitigate potential threats while our teams continue evaluation and remediation efforts. At this time, our investigation remains ongoing. We are working to provide product-specific guidance and will share additional information as it becomes available. Protecting our customers' data and systems remains our highest priority.

2. identified Oct 21, 2026, 10:44 PM UTC

   PowerSchool Response to Critical PHP Vulnerabilities: PowerSchool is aware of two recently disclosed critical vulnerabilities affecting PHP, CVE-2026-109618 and CVE-2026-109619. PHP is an open-source server-side programming language commonly used to support web-based applications. PowerSchool uses PHP within certain components of several products to support web and application functionality. Both vulnerabilities have been rated critical and security updates have been released for supported PHP versions. PowerSchool Security and Engineering teams are actively assessing our products and environments to determine potential exposure and implement appropriate remediation. Based on our assessment to date, the following PowerSchool products use PHP and are being evaluated and remediated as appropriate: Behavior Support Naviance NeverSkip Professional Learning Perform Enterprise PowerSource Schoology SchoolMessenger Communicate SchoolSpring Analytics & Insights Remediation and Mitigation: PowerSchool is actively working to apply applicable security updates across affected PowerSchool-hosted environments and to make applicable product updates available for self-hosted deployments. In parallel with these remediation efforts, PowerSchool is engaging with its Web Application Firewall (WAF) providers to evaluate additional protections intended to help reduce potential exposure. PowerSchool also continues to monitor its environments using endpoint detection and response (EDR) capabilities for indicators of suspicious activity. These measures provide additional layers of defense while patching remains the priority. For self-hosted customers, PowerSchool recommends applying the applicable PowerSchool-provided product update as soon as it becomes available. While remediation is underway, customers should consider implementing appropriate defense-in-depth measures within their environments, including leveraging available WAF and endpoint security protections and monitoring affected systems for unusual or suspicious activity. These additional measures are intended to help reduce potential exposure while remediation is underway and are not a substitute for applying the applicable PowerSchool-provided update. PowerSchool will continue to take appropriate remediation and mitigation actions as its assessment progresses.

3. identified Oct 21, 2026, 10:50 PM UTC

   We are continuing to work on a fix for this issue.

4. identified Oct 21, 2026, 11:49 PM UTC

   Correction: PowerSchool SIS was included in the original list in error and has been removed from the list below.