The following is a detailed account of the PHP security advisory originally released on Tuesday 20th October 2026, and our response and handling of the security advisory and actions taken for impacted Nottingham College websites or services.
In the past 24 hours, it had become clear that two new vulnerabilities in PHP (a server-side scripting language) had the potential to impact as much as 70% of websites worldwide. Before the release of patched versions to fix the identified vulnerabilities (released on Wednesday 21st October 3:00 pm BST), there was genuine concern about the severity of these new vulnerabilities, along with early signs that they were being actively exploited in the wild against real-world targets.
Nottingham College has several critical systems that are built with PHP. This includes:
In addition, one of our third-party vendors, Ticket Tailor, which is our event management platform for college events, such as Open Events, was also impacted. Various other services and apps you might use regularly may have been impacted today.
Both our main corporate website and our API app are run on cloud-based Platform as a Service (PaaS) hosting platforms. It also means that the platforms are entirely managed by third parties and not us directly, but we were in direct communication about the situation with all parties accordingly.
Our VLE system is hosted within the Nottingham College network on a more traditional virtualised server environment and was handled differently.
There have been a variety of news outlets reporting that various government websites and services were being voluntarily turned off or taken offline due to the nature of the security issue being reported. We did this for one PHP application, but not others, and we wanted to provide more details as to why and reassure that appropriate mitigation was in place for this to be possible.
Why was the Nottingham College website not taken offline until a patch was deployed?
The Nottingham College website is protected by Cloudflare through our provider Craft Cloud. Cloudflare provides a lot of services to its clients. One of their most well-known services is their Web Access Firewall (WAF). This is an important layer of blocking suspicious or bad requests before they even make it to your website or application, essentially filtering out bad actors. Before the release of the PHP security patches, Cloudflare had been working with the PHP Foundation, OpenAI, Wiz, and others to implement new WAF rules to detect these new PHP vulnerabilities by the signatures and patterns observed in web traffic. This was implemented on Wednesday 21st October 4:02 am BST, ahead of the 3:00 pm security advisory with full details. We therefore had strong confidence that despite having an unpatched version of PHP at the time, there was suitable mitigation in place to not warrant the action of voluntarily turning off our website, given the Cloudflare WAF would be actively blocking potential exploit attempts on unpatched PHP websites or applications.
Our hosting provider also confirms this in their blog update about php2shell. Our corporate website was patched approximately one hour after the public release of the security advisory and redeployed with a new PHP runtime with the patches without any downtime or disruption.
Why was the api.nottinghamcollege.ac.uk app not taken offline until a patch was deployed?
Our API app is a more bespoke PHP application designed for ingesting mostly public data from Open Data APIs at scale. Much of this is used for our digital signage platform to provide real-time or dynamic data for various services.
Our hosting provider for this application (fortrabbit) had given advance notification of emergency maintenance taking place for the PHP security advisory. They were actively monitoring traffic and had implemented at least one mitigation measure for the most common/known exploit path that was being observed while patching took place. We were also monitoring web traffic from this app carefully for any suspicious requests or spikes in unusual requests. We did not observe any during the window while this web application was not patched.
We therefore had strong confidence that, like our main corporate website, suitable mitigation was in place to require no further action. Our api.nottinghamcollege.ac.uk app was patched at approximately 4:22 pm BST.
Why was the VLE website taken down?
This was a voluntary action decided by our IT infrastructure and strategic systems teams. It was not due to any additional security incident or breach. When the 3:00 pm PHP security announcement was released publicly, everyone was rushing to get patches for their systems. This caused a huge load spike on all servers and mirrors hosting the patches, causing major delays for systems to get the patches and update through their respective platforms. Because of this, as the VLE could not be patched quickly enough, the decision was made to temporarily take the service down to avoid any potential compromise or security incident.
On further investigation out of hours, due to an outdated software repository for the current PHP packages installed, this has taken longer than originally anticipated to restore. We expect the VLE to be available by tomorrow (Thursday 22nd October).
We understand the impact on students due to this downtime, and we can only apologise for any disruption to your college coursework or learning during this time.
Why were Open Events not available to be booked through the Nottingham College website?
In a bizarre coincidence, Ticket Tailor experienced an earlier outage on the morning of Wednesday 21st October. This was unrelated to the PHP security advisory. It started just after 11:00 am and lasted for around 20 minutes. If you tried to book one of our Open Events during this time, you would likely have received an error from the checkout process.
Just before 3:00 pm BST, Ticket Tailor decided to suspend all services on their website because of the PHP security advisory. Ticket Tailor took the decision to take their service down, patch it, and then bring it back up to avoid any potential security issues or damage. Unfortunately, because of the problem of everyone hitting download servers for the latest PHP version/patches, this took 3.5 hours for them to be able to successfully download the patches needed to update their platform. They would likely not have intended for that process to take the amount of time it did. They have since sent an email to their customers explaining the delay.
As of around 6:15 pm BST, their service has been restored, and bookings for our Open Events are available again. We apologise if you had tried to book for one of our Open Events during this time. However, the decision from Ticket Tailor was outside of our control.
We were fortunate that our October Open Evening events had concluded and that our November events had not yet started. This would have had more impact if an Open Event had taken place on this date. This has highlighted a potential area that we should review backup options for check-in/bookings, such as printing a paper copy or similar, rather than relying on digital check-ins.
We hope this detailed account reassures you of our decision and handling of the impacted PHP web applications, as well as third-party areas for a situation that has had a global impact.