Security and privacy

Vulnerable plugins

Wed, 20 May 2026 11:05:06 GMT

von Michael Hawkins.

Hi Niki,

In the first instance, currently the best method is to check the Plugins directory for the maintainer and reaching out directly - sometimes they are linked to our bug tracker, and other times it's more direct contact (message/email via their profile, or reaching out via Github to check how they would like the information disclosed), as they are the primary people who are able to address any issues. Failing that, we are sometimes able to assist with informing plugin maintainers where they can't be reached by other means.

I cannot find any previous correspondence from you in the security inbox you mentioned, but please reach out via that email address again with further details, so we can try to assist you with responsible disclosure of your findings.

It is worth noting that in the future, this process will be much easier. A security reporting mechanism is on the roadmap for Moodle Marketplace (though that feature will not be available at launch, it will be available in the future).

Moodle vulnerabilities

Mon, 18 May 2026 09:30:08 GMT

von Ryn Janecks.

I’d also check the Moodle cache after making changes. I’ve had a few situations where things looked broken until I purged all caches and forced the theme/plugin data to rebuild properly.

CVE-2026-31431 - Will Moodle continue to function without problems after a kernel update?

Tue, 12 May 2026 13:17:34 GMT

von Marc Couture.

Unless you are disabling critical system services in the kernel, I wouldn't worry too much about Moodle having any issues.

CVE-2026-31431 - Will Moodle continue to function without problems after a kernel update?

Sat, 09 May 2026 02:14:17 GMT

von Visvanath Ratnaweera.

Debian 13 "Trixie" has already deployed the patched kernel. Debian 6.12.86-1 (2026-05-08). And the machine booted!

CVE-2026-31431 - Will Moodle continue to function without problems after a kernel update?

Fri, 08 May 2026 21:24:44 GMT

von Petr Skoda.

you'd do your testing on a staging server, never on a production server

CVE-2026-31431 - Will Moodle continue to function without problems after a kernel update?

Fri, 08 May 2026 16:48:38 GMT

von Ken Task.

OP has a moodle already installed and running. OP asked if an update to the Kernel would affect the moodle app. The checks.php script would be a quickie to see if the moodle is running ok.

But since you mention a full test, where does one do that via CLI?

'SoS', Ken

CVE-2026-31431 - Will Moodle continue to function without problems after a kernel update?

Fri, 08 May 2026 15:38:37 GMT

von Petr Skoda.

The only way to find out if server is compatible with Moodle is to run the full suite of PHPUnit and Behat tests. Environment check is for basic OS configuration validation only - it does not tell you if Moodle will actually run fine or not.

CVE-2026-31431 - Will Moodle continue to function without problems after a kernel update?

Fri, 08 May 2026 08:44:24 GMT

von Sergio Rabellino.

From my understanding, the kernel optimisation introduced for cryptography known as copy.fail, which was found hardly buggy, does not involve Moodle in any way.

But you can follow first the suggested mitigation action that can be reverted more simply if you (strangely) got some problems in Moodle, instead of going for the kernel update road.

CVE-2026-31431 - Will Moodle continue to function without problems after a kernel update?

Fri, 08 May 2026 07:59:13 GMT

von Visvanath Ratnaweera.

In theory, Moodle should work when the Server requirements in its Release notes, eg. https://moodledev.io/general/releases/4.5, are satisfied. I doesn't react to the kernel version as long as those software it depends on do function.

As you see here https://moodle.org/mod/forum/discuss.php?d=474096 no Moodle is still directly impacted.

CVE-2026-31431 - Will Moodle continue to function without problems after a kernel update?

Fri, 08 May 2026 07:19:32 GMT

von Ryotaro Yamada.

Thank you very much for your helpful information and comments.

I understand that kernel-5.14.0-611.49.2.el9_7 and later include the patch for AlmaLinux 9, and that you have not seen issues with Moodle on Rocky Linux 9 systems when checking with checks.php.

I also understand that this does not provide 100% assurance for our own environment, especially because server configurations, plugins, and operational conditions may differ.

We will use your comments as a useful reference, and we will consider applying the update first in a test environment, checking Moodle with admin/cli/checks.php -v and performing basic Moodle operation checks before updating the production servers.

Thank you again for sharing your experience.