Investigating - Critical PHP Vulnerabilities

Professional Learning and Perform Enterprise have now been patched, joining SchoolSpring, SchoolMessenger Communicate, Schoology, and PowerSource.

Remediation remains underway for Behavior Support, Naviance and NeverSkip. PowerSchool continues to prioritize patching for these remaining affected products.

SchoolSpring, SchoolMessenger Communicate, Schoology and PowerSource have been patched.

Remediation remains underway for Behavior Support, Naviance, NeverSkip, Professional Learning, and Perform Enterprise. PowerSchool continues to prioritize patching for these remaining affected products.

Please Note: PowerSchool has confirmed that PowerSchool SIS and Analytics & Insights are not affected by CVE-2026-109618 or CVE-2026-109619. These products were included on the prior list in error and have been removed from the list below.

Correction: PowerSchool SIS was included in the original list in error and has been removed from the list below.

We are continuing to work on a fix for this issue.

PowerSchool Response to Critical PHP Vulnerabilities:

PowerSchool is aware of two recently disclosed critical vulnerabilities affecting PHP, CVE-2026-109618 and CVE-2026-109619. PHP is an open-source server-side programming language commonly used to support web-based applications. PowerSchool uses PHP within certain components of several products to support web and application functionality. Both vulnerabilities have been rated critical and security updates have been released for supported PHP versions.

PowerSchool Security and Engineering teams are actively assessing our products and environments to determine potential exposure and implement appropriate remediation.

Based on our assessment to date, the following PowerSchool products use PHP and are being evaluated and remediated as appropriate:

Behavior Support
Naviance
NeverSkip
Professional Learning
Perform Enterprise
PowerSource
Schoology
SchoolMessenger Communicate
SchoolSpring

Remediation and Mitigation:

PowerSchool is actively working to apply applicable security updates across affected PowerSchool-hosted environments and to make applicable product updates available for self-hosted deployments.

In parallel with these remediation efforts, PowerSchool is engaging with its Web Application Firewall (WAF) providers to evaluate additional protections intended to help reduce potential exposure. PowerSchool also continues to monitor its environments using endpoint detection and response (EDR) capabilities for indicators of suspicious activity. These measures provide additional layers of defense while patching remains the priority.

For self-hosted customers, PowerSchool recommends applying the applicable PowerSchool-provided product update as soon as it becomes available. While remediation is underway, customers should consider implementing appropriate defense-in-depth measures within their environments, including leveraging available WAF and endpoint security protections and monitoring affected systems for unusual or suspicious activity.

These additional measures are intended to help reduce potential exposure while remediation is underway and are not a substitute for applying the applicable PowerSchool-provided update.

PowerSchool will continue to take appropriate remediation and mitigation actions as its assessment progresses.

PowerSchool is aware of recently disclosed critical security vulnerabilities affecting PHP. Our Security and Engineering teams are actively assessing the potential impact across our products and implementing protective measures as appropriate.

For PowerSchool-hosted environments, additional protections are being applied to help mitigate potential threats while our teams continue evaluation and remediation efforts. At this time, our investigation remains ongoing.

We are working to provide product-specific guidance and will share additional information as it becomes available. Protecting our customers' data and systems remains our highest priority.