PHP2SHELL

On 20 October 2026, the PHP security team announced two critical remote code execution vulnerabilities in the PHP interpreter, known as PHP2Shell. This advisory explains why the Ans platform is not affected.

Summary

Why Ans is not affected

PHP2Shell only affects servers that run PHP. Ans does not use PHP anywhere in its platform:

• The Ans application is built with Ruby on Rails and JavaScript.
• The servers that host Ans do not have PHP installed.
• Ans blocks uploads of .php files.

The Code editor question type offers PHP as a language for syntax highlighting. Ans displays the code students write, and never runs it. This means code in a Code editor question cannot be used to exploit PHP2Shell.

Third-party tools

Ans integrates with other systems, such as learning management systems (LMS) through LTI. Some of these systems, such as Moodle, run on PHP. PHP2Shell may affect these systems, depending on how they are hosted. Contact the administrator or supplier of these systems to check whether they are affected.

lightbulb_outline Subscribe to the Security advisory section to receive future security advisories from Ans.