Summary
On October 20, 2026, the PHP project announced a critical security vulnerability in how PHP processes certain web requests. Our security and operations teams looked at every SCORM Cloud service to see whether it was affected.
The core of SCORM Cloud does not run on PHP. That includes course import, launch, delivery, tracking, the REST API, and the SCORM Cloud website. These parts of the service were not affected.
One component, the Reportage reporting feature, uses PHP and was within the scope of the vulnerability. We moved quickly to protect it.
We have found no evidence that this vulnerability was exploited against SCORM Cloud, and no evidence that any customer data was accessed.
Mitigation steps taken
- Blocked the vulnerable request type: On the morning of October 21, we deployed rules that block the type of web request needed to exploit this vulnerability before it can reach Reportage. We applied them to every SCORM Cloud environment. Reportage doesn't need this type of request to work, so normal reporting was not affected.
- Hardened network access: We tightened network controls so that traffic can only reach SCORM Cloud through our protected content delivery network. This adds another layer of protection in front of the service.
- Checked for signs of compromise: We reviewed recent traffic logs, security monitoring alerts, and Reportage servers themselves. We found no signs of exploitation or unauthorized activity.
- Confirmed normal service: Before and after each change, we verified that SCORM Cloud and Reportage kept working normally. There was no customer-facing disruption.
What's next
The current protections are in place and working. We are also adding more layers of defense and making longer-term improvements to Reportage. We will update this article as that work is completed.
Do I need to do anything?
No. No action is required from SCORM Cloud customers. You don't need to change your configuration, API integrations, or credentials because of this issue.
Questions
We take the security of your data seriously. If you have questions about this issue or your account, please contact us at support@rusticisoftware.com.