You may have seen recent news reports about two critical security vulnerabilities in PHP, the software used by SchoolBooking and many other websites.
These vulnerabilities could allow an attacker to run unauthorised code on an affected server without logging in. On 21 October, the PHP team released security patches and advised organisations to update immediately. PHP 8.5.12 addresses both vulnerabilities. You can read the official PHP security advisory here.
SchoolBooking took immediate action, and all SchoolBooking services are running PHP 8.5.12, which includes the fixes for these vulnerabilities.
We have also reviewed our system and service logs and found no evidence that either vulnerability was exploited against SchoolBooking.
We prioritised this upgrade to protect our services and the information entrusted to us, following the PHP team’s recommendation to apply the security update immediately.
There is no security patch for customers to install; we manage these updates on our servers.
If you experience any difficulty, please contact us with your school name and details of the affected function so we can investigate promptly.