On October 21, 2026, the developers of PHP released emergency security updates for two critical vulnerabilities in the PHP core interpreter, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (CVSS v4.0) and can allow an unauthenticated attacker to run code remotely on an affected web server. Because details of these flaws became public before the fixes were released, please treat patching as urgent.
What UWIT is doing
To protect the University network, UWIT Information Security is isolating systems that are running vulnerable versions of PHP. Isolation is being done by null routing, and not by shutting systems down. That means:
- Affected systems will keep running, but network traffic to and from them will be blocked, so they won’t be reachable from the network.
- No data or configuration will be changed.
- Websites and services hosted on an isolated system will be unavailable until it’s patched and restored.
System owners are being notified when null routing needs to be put in place.
Additionally, the following are now sufficiently patched and should be functioning normally:
- All depts.washington.edu sites
- All students.washington.edu sites
- All UMAC-managed sites
What you should do
⇒ If you do not use a package manager, download and update to one of the fixed releases right away: 8.5.12, 8.4.27, 8.3.36, 8.2.35.
If you were contacted by UWIT about your site/system being null routed:
Once you have appropriately updated/patched PHP, please respond to the ticket you received from UWIT with the following information about the now-patched system:
- IP address
- Hostname
- Current PHP version
Once verified, UWIT Information Security will remove the null routing as soon as possible.
If you were NOT contacted by UWIT and your site/system is still unavailable after patching PHP:
Please contact UWIT for support.
Additional Considerations
PHP 8.1 and older (including 7.x and 5.x) may not receive a fix.
Some vendors are providing security fixes for older PHP versions: check with your vendor to confirm. Regardless, we recommend planning to move to a newer, supported branch of PHP as soon as possible, and consider taking internet-facing systems offline in the meantime.
Don’t forget PHP-based applications.
Any server hosting applications such as WordPress, Drupal, Nextcloud, and phpMyAdmin also needs the updated PHP version.
PHP provides additional technical info at their PHP security advisories and supported versions pages.
Questions or concerns
If you have questions about this issue or its effect on UWIT services, please contact UWIT and mention REF2420994.