PHP Critical Security Vulnerability

CVE-2026-109618 / CVE-2026-109619: Overview, affected systems, and remediation

 For the most up-to-date information and remediation steps, please view the Information Security Office (ISO) Advisory. 

ISO ADVISORY: View the most up‑to‑date ISO advisory 

VENDOR ADVISORIES: PHP; Ubuntu

PLATFORMS AFFECTED: PHP installations serving web requests (including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed) running PHP versions earlier than 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and end-of-life versions (PHP 8.1 and earlier), which should be treated as affected. Applications, control panels, containers, and appliances that bundle PHP are also affected.

SEVERITY: Urgent

IMPACT: Unauthenticated Remote Code Execution

Overview

On October 21, 2026, a critical security vulnerability was identified in PHP, software used by some university servers. If left unpatched, it could allow an unauthenticated attacker to compromise a server. The vulnerability may also affect some third-party applications and services used by the university.

According to PHP, all PHP installations serving web requests are at risk. Because the flaws are in PHP rather than in a particular application, any website or application running on an affected PHP version, including WordPress, Drupal, Laravel, and custom code, is at risk.

What's happening

SCS-Supported Systems

Our Unix Engineering team is actively reviewing SCS-supported systems that use PHP and applying patches where possible. If we determine that you need to take action, we will contact you directly with specific guidance.

Other Self-Managed Systems

Need help?

If you have questions or need assistance, please contact the SCS Help Center at 412‑268‑4231, submit a ticket, or email help@cs.cmu.edu.

We will continue to update this alert as more information becomes available.