Instructure

Instructure products affected by PHP (not individually named)

Response status

All affected products reported resolved

Response information checked

2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Provider of Canvas, Parchment and other education services.

October27 00:43 UTC update confirms resolution for all affected products, supplementing October22 customer-facing remediation.

Scope: Canvas is separately unaffected. This notice does not enumerate affected product names or fixed versions.

What users should do

Confirm product-specific scope with contracted support.

Official service URL

• https://www.instructure.com/

Source URLs

1. Instructure PHP2Shell responsehttps://trust.instructure.com/Response evidence
2. https://status.instructure.com/incidents/8ls99r63p98lhttps://status.instructure.com/incidents/8ls99r63p98lResponse evidence
3. https://status.parchment.com/incidents/9k5hd7dhv565https://status.parchment.com/incidents/9k5hd7dhv565Response evidence

Canvas application

Response status

Unaffected; no PHP

Response information checked

2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Trust Center and incident notice explicitly confirm Canvas does not use PHP.

Scope: Does not cover external integrations, customer PHP or other similarly named products.

What users should do

No Canvas PHP update is required for this incident.

Source URLs

1. Instructure PHP2Shell responsehttps://trust.instructure.com/Response evidence
2. https://status.instructure.com/incidents/8ls99r63p98lhttps://status.instructure.com/incidents/8ls99r63p98lResponse evidence