News by Levels · Level 3 · For teachers
Teacher guide & answers
Critical PHP Flaws Prompt Immediate Update Advice
How to use these two pages
Give learners the student worksheet. It contains the story and questions, without the answers. Keep this guide for yourself. Use it to lead the activity and explain the answers afterwards.
Student worksheetA simple 15–20-minute lesson
- Before reading · 2 minutes
Show the title. Ask: “What do you think this story is about?”
- Read and answer · 8–10 minutes
Give out the student worksheet. Learners read for the main idea, then reread to answer the 2 questions. They can compare answers with a partner.
- Discuss and write · 5–8 minutes
Check the answers below together. Ask learners to point to the clue in the story, then finish with the open question.
Adjust the support: Let learners use word help or Level 1 if needed. For a challenge, compare the wording in another level. This activity is not a proficiency test.
Answers to the 2 questions
The question numbers match the student worksheet. Each answer includes a reason and the clue learners can find in the story.
Which capability makes the vulnerabilities especially serious?
Correct answer: C — Run code on a server without signing in
Why: The text describes code execution without authentication, not just a visual error.
Clue in the story: An official PHP advisory identifies two vulnerabilities that can enable unauthenticated remote code execution. Fixed upstream releases include PHP 8.3.36 and 8.4.27.
What should operators verify rather than relying only on visible site changes?
Correct answer: B — Whether the hosting provider has installed the PHP fixes
Why: The fault is in PHP. Changing website text or browser history does not patch the runtime.
Clue in the story: Operators using vendor-maintained packages should check their provider's update status. A backported patch may protect an existing version without adopting a newer release number.
The open question: accept different answers
Ask learners: Why would editing a website’s articles not be enough to fix this issue?
One possible answer: The security issue is in PHP on the server. The hosting provider’s installed software needs the relevant fix.
This is an example, not the only correct answer. Look for a relevant idea, a reason and the learner’s own words. Learners can answer aloud or write one or two sentences.