Saylor Academy did not discover a breach in a learner account. It found PHP under the classroom, and it pulled the plug.
On 21 October the team emailed learners from notices@saylor.org. A serious flaw in PHP, the software behind the sites, had been announced that day. To protect accounts, Saylor Learn (learn.saylor.org) and Saylor University (degrees.saylor.org) would go offline while the hosting partner installed the fix.
The window in that email is 6:00pm to 10:00am Eastern Daylight Time, with a return expected by 10:00am EDT on Thursday 22 October. A public Saylor page has also shown 8:00pm to 10:00am EDT. Confirm the live banner on learn.saylor.org before you treat either clock as final.
What learners actually lost
For those hours you cannot sign in, open a course, take a quiz or exam, or download a certificate. Progress, grades, and certificates stay put. Nothing completed is wiped. If you are mid-quiz, the email says submit it before the window starts. If the work runs long, the update goes on the maintenance page at learn.saylor.org.
That is the whole incident, and it is the point. The scary sentence in a security mail is usually "we were hacked." This one is "you cannot get in, because we would rather be down than exposed."
Why a school is in this series
PHP2Shell is the public name for CVE-2026-109618 and CVE-2026-109619. PHP rates each 9.2. Both can allow unauthenticated remote code execution on a PHP install that is serving web requests. Fixes landed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP's own line is that updating is the only complete fix.
Saylor is not a hyperscaler. It is a free course platform with quizzes, exams, and certificates. That is exactly the data you do not leave on an unpatched runtime while a proof of concept is already circulating. The host installs the package. Saylor owns the outage message. Learners own the inconvenience.
The local version of the same mail
If your app is PHP and the image tag is older than those four releases, you are in the same bucket as learn.saylor.org. A laptop container is not exempt once it is reachable. Bump the tag, restart the workers, and do not call it patched until the new binary is the one answering requests.
Old workers keep the old code. That is the step people skip, and it is why a maintenance page exists at all.
Sources: Saylor learner notice, 21 October 2026; PHP security advisory.
