When the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were made public on October 21, learning platforms were among the services that went dark. Moodle HQ took its public and hosted client sites offline as a precaution, following advice from CERT-EU and the Australian Cyber Security Centre. By its final update on October 22, every hosted client site was patched and back online, with no evidence of exploitation or data access. Saylor Academy did the same, pausing its course sites while its host installed the fix.
For organisations running immersive training, this matters more than it first appears. A VR module rarely stands alone. Launch links, user accounts, completion records and scores often flow through a learning management system, an internal portal or a content back end, and many of those run on PHP. Because the weakness is in the PHP engine, updating the LMS itself is not enough; the server’s PHP runtime must be updated too.
Three lessons stand out.
Your training is only as available as its platform. Headsets and content can be ready, but if the LMS behind them goes offline, sessions stop. Ask vendors how they handle emergency patches, and plan a fallback, such as offline modules that sync results later.
Secrets live on the server. Security researchers showed that one PHP2Shell path can read server memory containing passwords, tokens and API keys from other requests. If your XR experience uses API keys for analytics, asset storage or single sign-on, rotate any credentials held on servers that ran unpatched PHP.
Ask what “patched” means. Guidance for Moodle administrators published on October 23 warned that a “patched” site may be running a backported PHP 8.1 package, which closes this flaw but not future ones. Confirm the fixed releases (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or a supported vendor build, and plan upgrades off end-of-life versions.
The UK’s National Cyber Security Centre has advised organisations to update PHP immediately or take affected systems offline. That is the right call, but downtime has a cost when hundreds of employees are booked into training. Planning ahead keeps that window short.
At PointZero Immersive Lab, we design immersive training to be resilient as well as engaging, planning for how content is delivered, tracked and secured, so a single back-end incident does not halt your learning programme.
