The patch is done. Here are five questions every campus should answer before the next alert.
On October 21, security researchers disclosed two critical vulnerabilities in PHP, the programming language that powers roughly 70% of websites. Collectively known as PHP2Shell, the vulnerabilities could allow an attacker to remotely execute code on a vulnerable server.
Because PHP underpins widely used platforms such as WordPress and Drupal, the vulnerabilities had implications for many campus websites. By now, most campus web teams have patched them.
It would be easy to move on. But for a lot of institutions, the hard part was never the patch. It was figuring out where it needed to go and whose responsibility it was to apply it.
Usually, the best defense for a WordPress or Drupal site is keeping the CMS and its plugins up to date. PHP2Shell raised a different kind of challenge. The flaw was in PHP, the language every WordPress and Drupal site runs on, so a site could be fully up to date and still be exposed. Drupal's message to its users was blunt: the hosting platform is the site owner's responsibility.
On a campus, the web footprint gets complicated fast. There's the main site, the college sites, admissions microsites, athletics, and the event page from three springs ago that nobody took down—spread across central servers, department servers, and vendors. If an institution is running Drupal or WordPress on its own servers, patching PHP is the institution’s responsibility, whether or not anyone has written that down.
Whether the web team or institutional leadership takes the lead, these questions are worth answering together while the week is still fresh:
An institution’s website holds applicant, student, and donor information and serves as the front door during enrollment season. That makes website security and ownership questions just as relevant to the cabinet as they are to the web team. It’s worth agreeing on the answers before the next alert arrives.
PHP2Shell put every organization running PHP-backed infrastructure to the test, including Modern Campus. Our response centered on speed and clarity of ownership: Modern Campus Hosted websites were fully patched by the afternoon of October 21, and Personalization was fully patched by October 23. Our review found no evidence of exploitation or customer compromise.
While our support team responded to more than 100 status inquiries, customers on Modern Campus-managed hosting did not have to identify servers, coordinate remediation, or apply the patches themselves. Modern Campus teams handled that work. Customers who self-hosted remained responsible for their own servers, with Modern Campus Support available to help them confirm their hosting model and next steps.
Drupal and WordPress are free to download, and that's always been part of the appeal for institutions. Moments like PHP2Shell are when the real bill comes due, often as server work that campus web teams never planned for. For institutions weighing that tradeoff, here's how a managed CMS compares with a self-hosted open source site.
PHP2Shell was found with the help of AI tools, and it probably won't be the last flaw found that way. Campus teams can patch a server. Most just proved it. The better question is whether they should have to.
Last updated: November 2, 2026.