{
  "is": "issue",
  "title": "PHP2Shell security vulnerability: UCware, Moodle, Mahara and LimeSurvey temporarily offline",
  "body": "\u003cp\u003e+++ UPDATE 2026-10-21 17:14 +++\u003c/p\u003e\n\u003cp\u003eSince a vulnerability has also been found in the updated version of PHP, the systems must remain shut down.\u003c/p\u003e\n\u003cp\u003eUnfortunately, eduVPN is also affected by the shutdown.\u003c/p\u003e\n\u003cp\u003e-\u0026ndash;\u003c/p\u003e\n\u003cp\u003eDear students,\ndear colleagues,\u003c/p\u003e\n\u003cp\u003eToday, a serious security vulnerability in the PHP programming language became known, referred to as “PHP2Shell.” Many web applications worldwide are based on PHP, including several HM systems. Among those affected are UCware, Moodle, Mahara, and LimeSurvey.\u003c/p\u003e\n\u003cp\u003ePlease note that as a result, telephony from the home office and from mobile phones using the UCware app is not possible.\u003c/p\u003e\n\u003cp\u003eWhat does this mean?\u003c/p\u003e\n\u003cp\u003eThrough the vulnerability, attackers could remotely execute programs on the affected servers. This could allow them to take control of the systems and read or modify data.\u003c/p\u003e\n\u003cp\u003eWhat is HM doing?\u003c/p\u003e\n\u003cp\u003eTo protect you and your data, we have proactively taken the affected systems offline. They will therefore be unavailable until further notice. As soon as the security updates are available and have been applied, we will bring the systems back online.\u003c/p\u003e\n\u003cp\u003eWhere can I find current information?\u003c/p\u003e\n\u003cp\u003eYou can find the current status at any time at \u003ca href=\"https://status.hm.edu\"\u003ehttps://status.hm.edu\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eAn easy-to-understand explanation of the security vulnerability is provided by the association \u003cem\u003eDeutschland sicher im Netz\u003c/em\u003e:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://www.sicher-im-netz.de/php2shell-kritische-sicherheitsluecken-gefaehrden-webseiten-und-onlineshops/\"\u003ehttps://www.sicher-im-netz.de/php2shell-kritische-sicherheitsluecken-gefaehrden-webseiten-und-onlineshops/\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eWe are aware that the outage restricts teaching, study, and administration. We are working hard to make the systems available again as quickly as possible, and ask for your understanding.\u003c/p\u003e\n\u003cp\u003eKind regards\u003c/p\u003e\n\u003cp\u003eYour HM IT\u003c/p\u003e\n",
  "createdAt": "2026-10-21 14:00:00 +0200 +0200",
  "lastMod": "2026-10-21 14:00:00 +0200 +0200",
  "permalink": "https://status.hm.edu/en/issues/2026-10-21-sicherheitsl%C3%BCcke-php2shell-ucware-moodle-mahara-und-limesurvey-vor%C3%BCbergehend-offline/",
  "severity": "down",
  "resolved": false,
  "informational": false,
  "resolvedAt": "<no value>",
  "affected": ["LimeSurvey", "Mahara", "Moodle-P", "Moodle", "Telefonie UCware", "VIMP", "Matomo", "Big Blue Button", "HAWKI", "eduVPN"],
  "filename": "2026-10-21-sicherheitslücke-php2shell-ucware-moodle-mahara-und-limesurvey-vorübergehend-offline.md"
}