PHP security update and ReachMyTeach’s response

On October 21, ReachMyTeach applied security updates to address newly disclosed vulnerabilities in PHP, a technology used by our platform and many other services worldwide.

Response and service availability

Our team alerted us early that morning, ahead of the security patch becoming available. Once updated packages were available for our environment, we tested the update in staging before deploying it to production that afternoon.

During the rollout, servers were updated and brought back online, resulting in intermittent availability and slower response times. We apologize for the disruption this caused. No messages were lost.

Security review

Following deployment, we reviewed available logs and security records leading up to the update for indications that the vulnerabilities had been exploited. The review included application and background-processing logs, web traffic records, AWS security findings, selected infrastructure activity, and Cloudflare security events. We examined these records for suspicious request patterns, relevant PHP errors, unexpected execution indicators, and unusual administrative activity.

Our review of available logs leading up to the update has found no evidence of successful exploitation of these vulnerabilities. Automated scanning attempts were observed. Such attempts do not, by themselves, indicate that an attacker gained access to our systems or customer data. Potentially relevant events were examined in context to distinguish suspicious activity from expected application behavior and maintenance.

Assessment and monitoring

These findings are based on the available records reviewed and should not be interpreted as a guarantee that every possible form of unauthorized activity can be ruled out.

We continue to monitor our systems as part of our regular security operations. Protecting the information entrusted to ReachMyTeach remains a priority.