Security Update – PHP Vulnerability

We are aware of the recent critical PHP security vulnerabilities highlighted by the National Cyber Security Centre (NCSC) on 21st October 2026.

We would like to reassure customers that our main platforms, 4Matrix Cloud and 4Matrix Fusion, do not use PHP and are therefore not directly affected by these vulnerabilities.

PHP is used within some of our supporting systems, including our customer support ticketing and billing systems. Our desktop application also communicates with our sales system for licence verification. These systems do not store customers' payment details or sensitive information as part of the licence verification process.

We have been in contact with our hosting provider, Krystal, who has confirmed that the necessary security fixes have been applied to address the reported vulnerabilities.

No action is required from our customers in relation to this advisory.

We take the security of our systems and customer information seriously and will continue to monitor security developments and work with our hosting provider to maintain appropriate protections.

In what order should I import data into 4Matrix?

Ultimately, it doesn't matter which year group you import first or whether it's actual results via an MIS Extract, assessment data via a spreadsheet, or GIAP data.

SIMS, Bromcom and Arbor users can create a complete series with just 1 import when importing actual results data, as the MIS Extract tool will pull through results, classes and contextual data in one go. The only exception to this is key stage 2/base data, which must be imported from GIAP. For all other MIS users, 4Matrix can import pupil information, classes and contextual data directly through our Wonde data extract tool.

When importing assessment data from spreadsheets, users may need to carry out up to 3 imports the first time that they import for a cohort:

  1. A spreadsheet containing pupil names/basic contextual information and subject grades 
  2. An import of class data, ideally via an MIS Extract (which can be used to obtain contextual data only for any year group)
  3. Basedata from GIAP: Key stage 2 Scaled Scores for key stage 4 progress measures; Key stage 4 APS data for key stage 5 progress measures

Basedata only needs to be imported once per cohort as this data attaches to the pupil record and not an individual series. This rule does not apply to pupil demographics/groups/class data as this is much more likely to change, and so this will need to be imported for each series, or copied between series using Admin > Edit Series > Actions > Copy Groups. This article gives more information about which data is series-focussed and which is pupil focussed https://www.4matrix.com/help/import/pupil-data-changes-overview.pdf

Some points of note:

  1. If you import pupil contextual/demographic information BEFORE assessments/results, you are likely to come across errors in the analysis tools because it can't find any grade data.
  2. You can import GIAP data into it's own series, but this is not necceasry. We recommend adding the GIAP data to an existing series where it will simply attach to the pupil records.

 

Article revised: 26/06/2024