PHP2SHELL

On October 21, 2026, the PHP development group disclosed two critical actively exploited Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619). These flaws affect PHP versions running from End-of-Life (EoL) releases from at least PHP 5.4 through PHP 8.5.11, allowing unauthenticated remote attackers to execute arbitrary code execution via requests to applications using PHP (e.g. Nextcloud, Drupal, phpMyAdmin, WordPress). 

To protect the University network, ITS has taken action to isolate affected systems from the internet. Administrators of affected systems using PHP or PHP-based applications must patch the vulnerability before the isolated system will be available again..

The isolated systems will not be accessible to anyone outside of the University. The isolated system will continue to run but any web sites and services hosted on it will be unavailable to the internet until it is patched. 

Required Actions

Individual notifications are being sent to admins of systems that ITS discovered might be running PHP, but that is not a definitive list and it's highly likely that systems/services with PHP were missing. Check your systems and applications to validate that you have access to them. 

If your system was isolated, you must perform one of the following actions:

  1. Update PHP Immediately: Upgrade your PHP installation to one of the following versions immediately: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
    1. To check what your current PHP version is you can run the following command: 
      1. php -v
    2. Rotate any credential, session token, API key, or certificate held by a PHP worker.
  2. End-of-Life (EoL) Versions: Systems that use PHP and PHP-based applications running EoL version of PHP (8.1 and lower) must be upgraded to the latest version of a supported PHP release.

Note: The ITS Web Hosting service running WordPress, Drupal and PHP/MySQL services have been updated to the latest PHP version.

Restoring Access to Isolated Systems:

Once you have updated your PHP installation, to request the isolation to be lifted. If you have confirmed that you are NOT running PHP on your system and believe that your system has been incorrectly identified, please upload evidence to the form. 

Resources: