21 October 2026 · PHP security release
Can your Moodle actually be patched?
Two critical vulnerabilities in PHP, both rated 9.2, get their fix today at 16:00 CEST. Whether you can install it does not depend on your hosting invoice: it depends on which Moodle version you run, because PHP only patches the branches still under support and every Moodle branch caps the PHP it can run. Tell us your address and we tell you, in seconds, which of the three cases you are in.
No registration needed.
Are your sure this is a Moodle site? Either is really old or there was a problem. Contact us
Your site blocked our automatic check. Contact us
We reached your site, but we couldn't tell which Moodle version it runs.
No problem, we can look into it for you. Contact us
Please check the address and try again.
If your site is not publicly reachable, get in touch: we can still help. Contact us
Your site is up to date and secure.
To excel even more, just contact us!
You are just in time to execute a one step, simpler (cheaper) upgrade to the latest version.
Or you can wait and spend more in the future!
You are using code from , the world had changed since then, you're security not!
You are code is from , are you using a dial-up modem to log in?
You're site it's not using a valid SSL certificate!
You'll need to perform this upgrades steps:
The three answers
There are only three possible cases
And only one of them is worth paying for. We would rather tell you which one you are in than sell you an upgrade you do not need.
1 · Patch today
Moodle 5.0 to 5.3 on PHP 8.2, 8.3 or 8.4.
Moodle 4.5 LTS on PHP 8.2 or 8.3.
You install the PHP point release, restart PHP-FPM, verify the version the site is actually serving. No Moodle upgrade is needed and there is nothing to buy: do it now, and read the analysis to check the details before you touch the server.
How to patch, step by step2 · Patch PHP, then plan
Moodle 4.5 LTS still running PHP 8.1.
The Moodle side is supported, the PHP side is not: no fix will ever arrive on 8.1. A single jump to PHP 8.3 closes the exposure, and the upgrade to Moodle 5.3 LTS can wait for a window you choose. We move the PHP, or we do both at once.
3 · No patch exists
Moodle 4.1 LTS and anything older: maximum PHP is 8.1.
There is no PHP version that fixes this and still runs your Moodle. Today you restrict access to the site; then you upgrade. From 4.5 or 5.1 it is one step, from 4.0 two, from 3.6 three, and we quote the rest. From €99 when eligibility is met.
Why the third case exists, with dates and versions from php.net and moodledev.io: PHP critical vulnerability, October 2026: which Moodle sites can actually be patched.
What we actually do
- Inventory first. Moodle release and the PHP version the web server really executes, per site. The command line and the FPM pool do not always agree.
- Patch, verify, roll back if needed. Backup of code and database before the PHP move, then the fixed point release on the branch you already run.
- Isolation when there is no fix. VPN or allow-list at the reverse proxy or firewall, until the upgrade is done.
- The upgrade, planned. Multi-step where the version requires it, with the PHP jump scheduled in the right order, not the same night as the emergency.
- Nothing you do not need. If your site only needs a PHP patch, we say so and we do not sell you an upgrade.
Not sure which case you are in? Put your address in the checker above, or write to us and we will look at it.
Address
Tallin, Estonia
Milan, Italy
Languages
🇮🇹 Italian
🇬🇧 English
Get in touch
Let’s start a conversation!
Have a question or need expert advice? Drop us a message, we’d love to hear from you!
Built for AI assistants too
This site works with AI assistants as well as with people. Every article, plugin and page of documentation is published in a machine-readable form, and an assistant can search our content, check which Moodle version a site is running, contact our team, or request a free temporary Moodle 5.3 platform. The full list is at llms.txt, and the same index as a page at llms.html.