Security Update: PHP Vulnerability

school.kiwi infrastructure was fully updated within hours of the patch being released.

Posted on Thursday 22 October, 2026

After the disclosure of critical vulnerabilities with PHP, a widely used programming language that powers the majority of websites around the world, we have completed all necessary security measures to fully patch all school.kiwi infrastructure. All of our web servers were fully updated within hours of the patch being released.

What does this mean for you?
KAMAR is based on FileMaker and does not use PHP. Therefore KAMAR itself is not affected by this vulnerability. Rest assured that KAMAR is safe, as is the school.kiwi Web Portal.

However, we have become aware that some schools who are self hosted may still have the old Web Portal hosted on one of their servers.

  • If this is on the KAMAR server itself, then we strongly recommend that you uninstall PHP and fully remove the old Web Portal files.
  • If this is on a separate web server, then check:
    • Is the sole purpose of that web server to host the old Web Portal? If so, we strongly recommend shutting it down.
    • If the web server also hosts other websites, then contact your IT support immediately and investigate their purpose before proceeding further.