No impact incident

PowerSchool Products: Investigating - Critical PHP Vulnerabilities

Affected: Behavior Support

Current status of PowerSchool Products: Operational — live PowerSchool Products status

Timeline

1. Oct 21, 2026, 16:32 UTC
   investigating
   PowerSchool is aware of recently disclosed critical security vulnerabilities affecting PHP. Our Security and Engineering teams are actively assessing the potential impact across our products and implementing protective measures as appropriate. For PowerSchool-hosted environments, additional protections are being applied to help mitigate potential threats while our teams continue evaluation and remediation efforts. At this time, our investigation remains ongoing. We are working to provide product-specific guidance and will share additional information as it becomes available. Protecting our customers' data and systems remains our highest priority.
2. Oct 21, 2026, 22:44 UTC
   identified
   PowerSchool Response to Critical PHP Vulnerabilities: PowerSchool is aware of two recently disclosed critical vulnerabilities affecting PHP, CVE-2026-109618 and CVE-2026-109619. PHP is an open-source server-side programming language commonly used to support web-based applications. PowerSchool uses PHP within certain components of several products to support web and application functionality. Both vulnerabilities have been rated critical and security updates have been released for supported PHP versions. PowerSchool Security and Engineering teams are actively assessing our products and environments to determine potential exposure and implement appropriate remediation. Based on our assessment to date, the following PowerSchool products use PHP and are being evaluated and remediated as appropriate: Behavior Support Naviance NeverSkip Professional Learning Perform Enterprise PowerSource Schoology SchoolMessenger Communicate SchoolSpring Remediation and Mitigation: PowerSchool is actively working to apply applicable security updates across affected PowerSchool-hosted environments and to make applicable product updates available for self-hosted deployments. In parallel with these remediation efforts, PowerSchool is engaging with its Web Application Firewall (WAF) providers to evaluate additional protections intended to help reduce potential exposure. PowerSchool also continues to monitor its environments using endpoint detection and response (EDR) capabilities for indicators of suspicious activity. These measures provide additional layers of defense while patching remains the priority. For self-hosted customers, PowerSchool recommends applying the applicable PowerSchool-provided product update as soon as it becomes available. While remediation is underway, customers should consider implementing appropriate defense-in-depth measures within their environments, including leveraging available WAF and endpoint security protections and monitoring affected systems for unusual or suspicious activity. These additional measures are intended to help reduce potential exposure while remediation is underway and are not a substitute for applying the applicable PowerSchool-provided update. PowerSchool will continue to take appropriate remediation and mitigation actions as its assessment progresses.
3. Oct 21, 2026, 22:50 UTC
   identified
   We are continuing to work on a fix for this issue.
4. Oct 21, 2026, 23:49 UTC
   identified
   Correction: PowerSchool SIS was included in the original list in error and has been removed from the list below.
5. Oct 22, 2026, 14:37 UTC
   identified
   SchoolSpring, SchoolMessenger Communicate, Schoology and PowerSource have been patched. Remediation remains underway for Behavior Support, Naviance, NeverSkip, Professional Learning, and Perform Enterprise. PowerSchool continues to prioritize patching for these remaining affected products. Please Note: PowerSchool has confirmed that PowerSchool SIS and Analytics & Insights are not affected by CVE-2026-109618 or CVE-2026-109619. These products were included on the prior list in error and have been removed from the list below.
6. Oct 22, 2026, 17:11 UTC
   identified
   Professional Learning and Perform Enterprise have now been patched, joining SchoolSpring, SchoolMessenger Communicate, Schoology, and PowerSource. Remediation remains underway for Behavior Support, Naviance and NeverSkip. PowerSchool continues to prioritize patching for these remaining affected products.
7. Oct 23, 2026, 15:29 UTC
   identified
   Naviance has now been patched, joining Professional Learning, Perform Enterprise, SchoolSpring, SchoolMessenger Communicate, Schoology, and PowerSource. Remediation remains underway for Behavior Support and NeverSkip. PowerSchool continues to prioritize patching for these remaining affected products.
8. Oct 24, 2026, 13:50 UTC
   resolved
   Behavior Support and NeverSkip have now been patched. With these updates complete, all affected PowerSchool products have now been successfully patched.

Updates as published by PowerSchool Products (original).