【Cybersecurity Notice】A Significant Security Flaw Identified in PHP; Prompt Inspection and Updating Required by All Units

Dear Colleagues, Faculty, and Students,

It has recently come to our attention that a critical security vulnerability exists within the PHP runtime environment (CVE-2026-109618, CVE-2026-109619). Proof-of-concept exploits have already surfaced online. Malicious actors may exploit specially crafted web requests to execute unauthorized code on affected web servers without authentication, thereby posing a substantial risk of website or host compromise.

PHP serves as the execution environment for numerous websites, including platforms such as WordPress, Drupal, and Joomla. Websites operating on vulnerable PHP versions that remain unpatched are susceptible to cybersecurity threats.

1. Which Systems Are Affected?

The following PHP versions fall within the scope of this advisory:

• PHP 5.4 through 5.6

• PHP 7.0 through 7.4

• PHP 8.0 through 8.1

• PHP 8.2.34 and earlier

• PHP 8.3.35 and earlier

• PHP 8.4.26 and earlier

• PHP 8.5.11 and earlier

End users are not required to install or update PHP themselves; such actions should be undertaken by website administrators or system maintenance vendors.

2. Recommended Actions for Each Unit

(a) Website and System Administrators

1. Immediately inventory all self-managed or outsourced websites to verify PHP usage and current version.

2. Systems identified as vulnerable should be promptly updated to the officially patched secure versions, ensuring all website functionalities remain intact post-update.

3. If immediate updates are unfeasible, assess the feasibility of restricting external connections, suspending public services, or implementing other effective isolation measures to mitigate attack risks.

4. Should any abnormal connections, website defacements, or suspected intrusions be detected, promptly follow the institution’s cybersecurity incident reporting procedures.

(b) General Faculty, Staff, and Students

1. Refrain from downloading or installing unverified patches from unknown sources.

2. If you observe abnormal website behavior, defacement, or service disruptions within the institution, promptly notify the website management team or the Office of Library and Information Services.

3. Comply with any cybersecurity notifications received and follow the prescribed instructions.

3. Official Patch Versions

Website administrators are advised to update PHP to the following versions or later supported secure releases:

• PHP 8.2.35

• PHP 8.3.36

• PHP 8.4.27

• PHP 8.5.12

Note that PHP 8.1 and earlier versions have ceased receiving official general maintenance; it is strongly recommended to plan an upgrade to supported versions at the earliest opportunity.

Official update information and downloads are available at:
https://www.php.net/downloads.php

4. Important Reminders

This vulnerability primarily affects websites and related servers running the impacted PHP versions; not all personal computers or internal information systems are at risk.

All website administrators and outsourced maintenance vendors are urged to complete inspections and necessary mitigations promptly. If immediate patching is not possible, appropriate protective measures should be implemented, including suspending external services if necessary, to reduce cybersecurity risks.

Reference Materials:

• NVD: CVE-2026-109618
  https://nvd.nist.gov/vuln/detail/CVE-2026-109618

• NVD: CVE-2026-109619
  https://nvd.nist.gov/vuln/detail/CVE-2026-109619

• Official PHP Security Announcement
  https://www.php.net/archive/2026.php#2026-10-20-1

Respectfully,
Office of Library and Information Services