Security update: SmartClass has applied the October 2026 PHP security fixes

October 2026 security update

Protecting the information that schools, families and students entrust to SmartClass is our first responsibility. This announcement explains a security issue that the PHP project disclosed on 21 October 2026, what it means for SmartClass, and exactly what we have done about it.

In brief

• The PHP project published a security advisory about two critical vulnerabilities in PHP and released fixed versions the same day.
• Every SmartClass server that runs PHP now uses PHP 8.3.36, the official release that fixes both vulnerabilities.
• We also added the protective settings that the advisory recommends, and we are keeping them as an extra layer of protection.
• You do not need to install anything, change any setting or update the SmartClass mobile app.

What happened?

PHP is a widely used programming language that runs a large share of the world’s websites. SmartClass uses it on its servers for the web application, its programming interface (API) and background services such as notifications and scheduled tasks.

The two vulnerabilities, registered as CVE-2026-109618 and CVE-2026-109619, are in PHP itself rather than in SmartClass’s own code, and they affect PHP installations all over the world. Under certain conditions, a specially crafted request to an affected server could let an attacker run their own code on that server without signing in. The PHP project rated them critical and fixed them in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What we did

1. Added the recommended protective settings

On the day of the advisory, we added the configuration changes that the PHP project recommends to our server configuration:

• We turned off session upload progress tracking. SmartClass does not use this PHP feature, and the advisory identifies it as a path to one of the vulnerabilities. The setting is part of the main PHP configuration, so it applies before any request is processed.
• We lowered the largest single file the servers accept from 20 MB to 16 MB, so that it stays below the overall request size limit, as the advisory recommends.

2. Updated every server to the fixed PHP release

We then updated every SmartClass server that runs PHP to PHP 8.3.36, the fixed release of the PHP version SmartClass uses. This covers every part of the service that runs PHP:

• the servers that run the SmartClass web application and its API;
• the classic SmartClass pages, which run on the same updated servers;
• the background services that send notifications and messages and run scheduled tasks.

Our server build configuration names the exact version, 8.3.36, rather than a general “latest 8.3” label. Every server we build from now on receives the fixed version, and an older release cannot be installed by mistake.

3. Tested on the same version

Our automated checks for SmartClass API updates run on the same PHP 8.3.36 release, so the version our customers use is the version we test.

4. Retired an older PHP version

We also retired the PHP 7.4 environment that our team used internally for the classic pages. For customers, these pages already ran on the updated servers; with this change, our development and test environments use the same patched version as well.

What does this mean for you?

SmartClass is a hosted service, so the update was made on our servers and is already in effect for every school. You do not need to:

• install anything on your computer;
• update the SmartClass mobile app, which does not run PHP on your phone or tablet;
• change any SmartClass setting.

SmartClass works as before. The only difference you might notice is the new 16 MB limit for a single uploaded file, which applies only in the few places that previously accepted larger files.

Our ongoing commitment

We follow the security advisories for the software SmartClass depends on and apply fixes promptly. On 23 October 2026, the PHP project published a follow-up note recommending that session upload progress tracking stay turned off until its next regular release. That setting was already part of the changes described above, so no further change was needed.

The PHP project’s original advisory is available, in English, in the PHP news archive.

If you have any questions about this update, or notice anything unusual in your account, please contact your institution or SmartClass Support.