Prepare for Reported Critical PHP Vulnerabilities

Please visit the ITS Status Service Status Page for updates regarding these vulnerabilities.

This message is intended for U-M IT staff responsible for systems, websites, applications, appliances, containers, or hosting environments that use PHP.

Summary

Two critical vulnerabilities in PHP permit remote code execution. These vulnerabilities affect all systems using PHP. Patches are currently being released. Units should inventory systems that use PHP and take actions listed below and watch for the announcement of upcoming PHP security releases.

Problem

Two PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are critical remote-code-execution flaws rated CVSS 9.2. Patches are being released. The PHP project is only providing fixes for currently-maintained versions of PHP, but other vendors are working on making fixes available for older PHP versions. 

Threats

The vulnerabilities have the potential to allow remote code execution, which could allow an attacker to run commands with the privileges of the PHP or web-server process. In addition, lateral movement across university systems may be possible.

Affected Systems

Any systems and applications that use PHP (version 5.0 or higher) are affected, including websites, web servers, IoTs, and applications. Cloudflare provides a level of protection but does not fully take care of the problem - action is still required. See action items below.

Patches will be released for PHP 8.2 and newer. Older PHP versions pose a major risk.

Action Items

  • Inventory systems running PHP, including those in web servers, containers, appliances, control panels, and vendor-provided software.
     
  • For systems that are not behind Cloudflare:
    • Put them behind Cloudflare if possible (and take the steps below for systems already behind Cloudflare).
    • If it is not possible to put a system behind Cloudflare, ITS strongly recommends that if units have any systems on the public internet that could be running PHP, they should either restrict it to the campus internet or to known IP addresses, or shut it down.
  • For systems that are behind Cloudflare
    • Cloudflare provides a level of protection but does not fully take care of the problem - action is still required.
    • You can minimize the amount of work to move the system behind Cloudflare by configuring Cloudflare not to cache any content for the site (Cloudflare dashboard users can do this themselves by going to Caching -> Cache Rules -> add the system's FQDNs to the rule "U-M managed: Sites for which Cloudflare should never cache any content" and enable it).
    • Restrict traffic to the server so it only allows traffic from Cloudflare networks and trusted U-M IP addresses on ports 80 and 443, in order to enable full protection from Cloudflare.
    • This is a temporary measure. Continue to look for patches and apply them as soon as possible.
  • Watch for announcements of patches to address the critical vulnerabilities and apply immediately as soon as they are available.
  • Prepare to test and deploy verified vendor updates.
  • If suspicious activity is detected, isolate the affected system where operationally appropriate and preserve relevant web-server, PHP, endpoint, and network logs before remediation.

Information for Users

Users should report any suspicious activity to the ITS Service Center.

Questions, Concerns, Reports

Please contact ITS Information Assurance through the ITS Service Center.