Back It.Uw.Edu

Critical PHP vulnerabilities - Information Technology (UW-IT)

It.Uw.Edu • October 21, 2026

On October 21, 2026, the developers of PHP released emergency security updates for two critical vulnerabilities in the PHP core interpreter, CVE-2026-109618 and CVE-2026-109619 . Both are rated 9.2 (CVSS v4.0) and can allow an unauthenticated attacker to run code remotely on an affected web server. Because details of these flaws became public before the fixes were released, please treat patching as urgent.

To protect the University network, UWIT Information Security is isolating systems that are running vulnerable versions of PHP. Isolation is being done by null routing , and not by shutting systems down. That means:

Affected systems will keep running , but network traffic to and from them will be blocked, so they won’t be reachable from the network.

No data or configuration will be changed.

Websites and services hosted on an isolated system will be unavailable until it’s patched and restored.

System owners are being notified when null routing needs to be put in place.

All depts.washington.edu sites are now sufficiently patched and should be functioning normally.

All students.washington.edu sites are now sufficiently patched and should be functioning normally.

All UMAC -managed sites (including uw.edu, admit.uw.edu, and hr.uw.edu) have stop-gap mitigation in place and have been put into read-only mode; fully patched versions of PHP are currently being rolled out.

A few things to keep in mind:

PHP 8.1 and older (including 7.x and 5.x) will not receive a fix. If you run one of these versions, plan to move to a supported branch as soon as possible, and consider taking internet-facing systems offline in the meantime.

Don’t forget PHP-based applications such as WordPress, Drupal, Nextcloud, and phpMyAdmin: any server hosting them needs the updated PHP version.

PHP provides additional info at the PHP security advisories and supported versions pages.

Questions or concerns

If you have questions this issue or its effect on UWIT services, please UWIT and mention REF2420994 .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 785 sources 73

Extracted Entities

Critical PHP vulnerabilities - Information Technology (UW-IT)

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

Domains (5)

MITRE ATT&CK (1)

Platforms (5)