Working in educational technology often means relying on software hosted on web servers, and Xerte is one such tool. Like many organisations, we have become increasingly familiar with reports of vulnerabilities, requests for urgent security patches, and the careful work required from technical teams to update, test and maintain systems securely.

There is now another factor changing this landscape: AI.

Apereo, the organisation that sponsors a range of open-source projects including Xerte, recently discussed security in the AI era. AI tools can help developers write and review code, but similar capabilities can also be used to analyse software and publish security information much more quickly. This can make it easier to identify potential weaknesses and, in some cases, find ways to exploit them.

This does not mean that every piece of software is suddenly unsafe, or that AI itself is the attacker. It does mean that vulnerabilities may be discovered and acted upon more quickly than before, increasing the pressure on software maintainers and hosting teams to respond promptly.

Last week gave a good example of how this works in practice. Xerte runs on PHP, a widely used piece of software that powers a huge number of websites. On 21 October 2026, the PHP team released an important security update after researchers, helped by AI tools, spotted weaknesses that needed fixing. This is the system working as it should: problems were found, reported responsibly and fixed.

This isn’t a problem with Xerte itself, and authors and learners don’t need to do anything. Behind the scenes, though, the teams who look after Xerte servers need to apply the update, check that everything still works as expected and keep an eye out for any further changes. That takes time and care, and it may mean Xerte is briefly unavailable while the work is done. If that happens, a little patience goes a long way, as it gives those teams the space to do the job properly.

What does this mean for open-source software such as Xerte?

For the volunteers who maintain and develop Xerte, as well as the people supporting this website and the Xerte documentation, it can mean more security reports to investigate, more updates to prepare and test, and more time spent responding to emerging threats.

The same is true for organisations and individuals hosting Xerte on their own web servers. Keeping software up to date has always been an important part of running a secure service, but the changing security landscape may require greater vigilance and sometimes a faster response.

What does this mean for Xerte authors and learners?

For most authors and learners, the visible impact may simply be that Xerte occasionally needs to enter maintenance mode while an update is applied and checked.

That can understandably be frustrating, particularly when people are trying to teach, learn or meet a deadline. But behind those interruptions are technical colleagues and open-source volunteers doing careful work to protect the service and the people who use it.

As AI changes both software development and cybersecurity, one of the most useful things the wider Xerte community can offer is patience and support for those teams. Security updates can be inconvenient, but the work involved in responding to them is an important part of keeping Xerte safe, reliable and available for everyone. 

[Article refined with Claude]