Computing Services issued a security alert on October 22, 2026, reporting a critical vulnerability in PHP that affects university servers and websites running outdated or unpatched PHP. If not addressed, the flaw could allow unauthorized attackers to compromise those servers. The vulnerability may also impact third-party web applications and services used across the university.
PHP vulnerability: scope and immediate actions
Computing Services and campus IT teams are assessing systems, applying required security patches and testing infrastructure to mitigate the issue. Administrators warn that some services and web applications may be temporarily taken offline while updates are implemented.
Application owners and web administrators are instructed to review the remediation guidelines immediately. Applications that remain unpatched risk being blocked or having their server access restricted to protect network security. Administrators responsible for third-party-hosted services are also encouraged to confirm whether those systems are patched or remain unprotected.
Last Updated: 10/22/26
