Statement from Edookit s.r.o. regarding the PHP Security Vulnerability (PHP2Shell)

On October 20, 2026, a critical security vulnerability in the PHP programming language, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), was disclosed. Under certain circumstances, this vulnerability could have allowed an attacker to execute arbitrary code on a compromised server.

As the Edookit system uses PHP technology, this security threat also affected our infrastructure.

Immediately after the PHP developers released a security patch on October 21, 2026, we deployed it across all Edookit servers. At the same time, we conducted a security review to identify any potential attempts to exploit this vulnerability.

Our investigations found no evidence of a successful attack on the Edookit system or of any unauthorized access to school or user data.

We would like to reassure all schools, teachers, parents, and students that no action is required on their part. All necessary security measures and updates have been implemented centrally by our team.

The security of the Edookit system and the protection of the data entrusted to us have long been among our top priorities. We continuously monitor security threats, regularly assess our infrastructure, and respond to newly identified risks without unnecessary delay.

We thank our customers for their trust.

Edookit s.r.o.