Security Update – PHP Vulnerability

We are aware of the recent critical PHP security vulnerabilities highlighted by the National Cyber Security Centre (NCSC) on 21st October 2026.

We would like to reassure customers that our main platforms, 4Matrix Cloud and 4Matrix Fusion, do not use PHP and are therefore not directly affected by these vulnerabilities.

PHP is used within some of our supporting systems, including our customer support ticketing and billing systems. Our desktop application also communicates with our sales system for licence verification. These systems do not store customers' payment details or sensitive information as part of the licence verification process.

We have been in contact with our hosting provider, Krystal, who has confirmed that the necessary security fixes have been applied to address the reported vulnerabilities.

No action is required from our customers in relation to this advisory.

We take the security of our systems and customer information seriously and will continue to monitor security developments and work with our hosting provider to maintain appropriate protections.

Unhandled Exception (Object Reference) error occurs when trying to access tools in 4Matrix

These errors are usually non-specific and may require a Support Agent to check.

First of all, check you're using the latest version of 4Matrix by going to Help > About 4Matrix and cross-reference this with the version shown at www.4matrix.com/downloads

The most common causes for these errors are:

  • No 'grade' data in the system - most likely after clearing the demo database. Once the user has imported a series containing subjects and grades this error should no longer appear.
  • Duplicate subject names in the same key stage or conflicts with a field in the database (such as Photography being shortened to Photo which is also a field in the database for storing pupil photos)
  • A subject with an incorrect weighting of 0 
  • A custom field is not named (i.e. it's blank), duplicated or conflicts with the name of a field in the database

 

To fix, follow the steps below:

  1. Go to Admin > Edit Subjects and check the subject names in use in both Current and Other series. Make sure there are no 2 subjects named identically. If there are, rename duplicates slightly.
  2. If the problem persists, in Edit Subjects click on the first subject in the list and use the down arrow key to scroll through and check the Weight field in the top right of this display. Contact us if any show as 0.
  3. Finally, in Admin > Edit Pupils, check that there are no custom fields in use without a name i.e. the field name is blank, and make sure that you are not using a default 4Matrix field name such as Photo, UPN, class etc.

If none of the above appear to be the cause, to resolve the problem please provide us with the following information:

  • When does the error occur and in which tool?
  • Does it occur when opening the tool or when trying to use particular functionality such as the Groups control?
  • Does the same error occur for all users?
  • Is the problem related to a specific series?