Howard Miller

Ok - my first check for this kind of thing is 'Is it really version 3.6.10?'. So, I looked up 3.6.10 in Github and checked some of the error messages made sense. I didn't get far...

PHP Warning: is_dir() expects parameter 1 to be a valid path, string given in /kucmwbi/www/moodle/lib/classes/component.php on line 648
https://github.com/moodle/moodle/blob/v3.6.10/lib/classes/component.php

The is_dir() call is on line 649, not 648. It's a small thing but points to some possible mix up of code.

Moodle 3.6 has been completely unsupported for nearly 5 years. So, that's not good.

I need to have a think about the above. There's no reference at all to optional plugins. My first thought is that you have added much newer software incompatible with your (old) version. If you have added any plugins recently, you should just be able to delete them.

It creates course backup files. The advantage is that you can then restore a course (e.g. if somebody does something stupid). It's not a replacement for a 'disaster recovery backup'; it's something else, entirely.

Yes - you can point the output wherever you like. The docs I pointed you to explain it.

As Chris says... it's almost the exact antithesis of a vulnerability

Are you sure that the sessions are being stored to the database? I think you'll find that they are not. Only the session identifier is stored in the table if you are not using db sessions. And that is normal.

I've said this a few times recently, but I would strongly recommend you consider moving to Redis for sessions.