PHP2Shell: Motional investigation summary

Summary

We found no evidence that the PHP2Shell vulnerabilities were used against Motional, or that anyone accessed school data.

PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. They could let an attacker run code on a web server without logging in. Like most PHP applications, Motional was exposed until the fix shipped. We took the application offline, patched it, and investigated our production environment, which holds school data.

Timeline

The application was offline from 00:15 UTC on 21 October until about 22:15 that evening, after the fix was installed.

22 Oct – We investigated logs, servers and application data, and found no evidence of compromise
21 Oct, 22:09–22:30 – Fixed PHP installed, application redeployed and servers restarted
21 Oct, 14:00 – The PHP project released fixed versions
21 Oct, 00:15 – Application taken offline behind a maintenance page
20 Oct – Vulnerability details became public
17 Oct – Earliest exploitation attempts seen by security researchers

What we checked

We checked everything from the server’s first day in service (30 September) to 22 October, so the whole period before the fix is covered.

• Web and server logs: every request and error, searched for the known signs of both vulnerabilities, worker crashes, oversized requests and scanning tools.
• The server itself: running processes, network connections, recently changed files in every deployed copy of the application, scheduled tasks, login keys, and whether any system software had been altered.
• Application data: new accounts, administrator accounts and permissions, password, two-factor and passkey changes, administrator actions, and the application’s audit trail. This included any activity while the application was offline.

What we found

• Everything we found is explained by normal use of Motional or routine automated scanning of the internet.
• No signs of exploitation. None of the known signatures of either vulnerability appear in our logs. Our server settings also made the first vulnerability’s known attack method unlikely to work.
• Only routine scanning. The unusual requests were generic automated scans that hit every website. They were refused, and none sent the kind of request these attacks need.
• Nothing left on the server. We found no unexpected programs, network connections, files, scheduled tasks or login keys, and no altered system software.
• No unauthorised access to accounts or data. No new administrator accounts and no permission changes. Every password and security change traces back to a user’s own action, such as signing in or resetting a password.
• Nothing happened while we were offline. No sign-ins, new accounts or data changes were recorded.

Precautionary actions

We patched on the day the fix was released, and we’re taking further steps even though we found no compromise.

• Patched: production runs a fixed PHP version and was restarted onto it on 21 October.
• Credentials: we are rotating the application’s passwords and keys. Researchers have described a related flaw that can leak data from memory without leaving a trace, so we’re replacing them as a precaution.
• Hardening: we are removing access we no longer use and tightening server configuration.

Schools don’t need to do anything. We found no evidence that passwords or any other data were exposed.

Data protection

We have concluded that there was no personal data breach, so no breach notification is required. Motional processes school data on behalf of schools, which are the data controllers. We would tell any affected school without undue delay if that changed. We have recorded this assessment and the evidence behind it.

If you have questions about this incident, contact Neil via our support system.