Body
Summary
Emergency security updates are available for two critical vulnerabilities in the PHP core interpreter: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4.0 and may allow an unauthenticated attacker to run code remotely on an affected web server. Because details were public before fixes were released, system owners should patch affected systems immediately.
Overview
Purdue IT Information Security is isolating systems that run vulnerable PHP versions. Isolation uses null routing rather than shutting down the system.
- Affected systems continue running, but network traffic to and from them is blocked.
- No data or configuration is changed.
- Websites and services hosted on an isolated system remain unavailable until the system is patched and restored.
When possible, system owners are notified when null routing must be applied.
Instructions
Update PHP
- If PHP was installed through your operating system package manager, monitor your vendor and apply its updated packages.
- If you do not use a package manager, update immediately to a fixed release: 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- Confirm that PHP-based applications, including WordPress, Drupal, Nextcloud, and phpMyAdmin, use the updated PHP version.
Restore access to web services
If Purdue IT contacted you about an isolated site or system, submit a ticket to Purdue IT (using the "Purdue IT Request" button on the right side of this page) after patching to restore access.
Please Include:
- Owner Name/Contact
- IP Address
- Hostname
- Current PHP version & Software Name
After verification, Purdue IT Information Security will remove the restrictions as soon as possible.
If Purdue IT did not contact you and your site or system remains unavailable after patching PHP, contact Purdue IT (using the "Purdue IT Request" button on the right side of this page) for support options.
Additional considerations
- PHP 8.1 and older, including PHP 7.x and 5.x, may not receive a fix.
- Some vendors may provide security fixes for older PHP versions. Confirm availability with your vendor.
- Plan to migrate to a newer, supported PHP branch as soon as possible.
- Consider taking internet-facing systems offline until they can be patched.
Still need help? Please contact Purdue IT (using the "Purdue IT Request" button on the right side of this page).