[Ucrfacultyandstaff] Immediate Action Required by Faculty and Staff Who Manage Websites, Web Apps, and Servers Running PHP

Thu Oct 22 10:47:59 PDT 2026

[image: UC Riverside logo.]
Global PHP Vulnerability Requires Immediate Action

If you manage a website, web application, or server that uses PHP,
including a personal, lab, or department site, you must update it
immediately to address a critical global PHP vulnerability. Vulnerable
sites will be blocked to protect our campus community.

Dear Colleague,

A critical security vulnerability in PHP, a common technology behind many
websites and web applications worldwide, is being actively exploited by
attackers. If you run a website, web application, or server that uses PHP,
you must update it immediately.

Why This Is Urgent

PHP powers many popular website platforms, including WordPress and Drupal,
and many custom web applications. On October 21, 2026, emergency fixes were
released for two serious flaws. Attackers are already using these flaws to
take control of unpatched servers, without needing a password. A single
compromised server can put research data, personal information, and the
broader campus network at risk.

Does This Affect Me?

Most faculty and staff do not need to take any action. You do not need to
do anything if you only use websites, or if your website is fully managed
by ITS.

Please take action immediately if you personally manage or pay for any of
the following:

   -

   A website for your lab, research group, center, course, department, etc.
   -

   A personal faculty or project website hosted on a campus server
   -

   A server or virtual machine running web software, on campus or in the
   cloud
   -

   A site set up years ago by a student, staff member, or vendor that may
   still be running
   -

   A web application

If you’re not sure whether your site or application uses PHP, it’s
important to check (find guidance in the "How to Check for PHP Use" section
below).

How ITS Is Responding

ITS is updating all centrally managed systems and contacting known website
managers directly.

To protect campus from active attacks, the Information Security Office is
scanning for vulnerable systems. Starting immediately, if a vulnerable PHP
site or web app on UCR’s network or services is detected, ITS will block
access to it at the campus firewall until it is updated. Blocked sites will
be unreachable from outside the campus network.

Steps to Take

   1.

   Identify any websites or servers you manage that may use PHP.
   2.

   Update PHP immediately or contact your provider to do so. If you manage
   the website, app, or server yourself, update PHP to the latest patched
   version (PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or later) right away. If a
   vendor, hosting company, or former student set up your site, contact them
   today and ask them to apply the October 21 PHP security updates.
   3.

   Tell us about it. If you manage a site or web that ITS may not know
   about, or need help, please call BearHelp at 951-827-4848 or submit a
   ticket at its.ucr.edu/help. Include the language “PHP Vulnerability” in
   your ticket. These tickets will be escalated to receive immediate support.
   4.

   If your site is blocked, contact ITS. Once the site has been updated, we
   will verify the fix and restore access.

Need Assistance?

   -

   Submit a ticket at its.ucr.edu/help
   -

   Call BearHelp at (951) 827-4848 (Monday to Friday, 8:00 AM to 5:00 PM)
   -

   Contact your departmental or collegiate IT lead (if not ITS)

Thank you for your prompt attention and partnership. Your quick action
helps keep our campus community, and the research and teaching it supports,
safe.

Sincerely,

Matthew Gunkel

Chief Information Officer and Associate Vice Chancellor

Dewight Kramer

Chief Information Security Officer

Information Technology Solutions

University of California, Riverside

How to Check for PHP Use

It is possible to figure out whether a website, web application, or server
is using PHP without technical knowledge by answering a few simple
questions:

   1.
   What platform was used to build the site?

This is the fastest check. These common platforms all run on PHP:

   -

   WordPress
   -

   Drupal
   -

   Joomla
   -

   Moodle
   -

   MediaWiki (wiki sites)
   -

   Omeka (digital collections and exhibits)
   -

   LimeSurvey (surveys)
   -

   phpBB (forums)

Many lab, center, conference, department, and faculty sites from the past
15 years are WordPress or Drupal.

   2.
   What information is in the web address?

Signs that a site likely uses PHP:

   -

   Page addresses ending in .php, such as index.php or contact.php
   -

   Login pages at /wp-admin or /wp-login.php (WordPress)
   -

   Login pages at /user/login (Drupal)
   -

   Login pages at /administrator (Joomla)
   -

   Images or files stored under /wp-content/ (right-click an image and
   choose “Copy image address” to see this)

3. Check inside the site’s dashboard, if you can log in.

   -

   In WordPress, go to Tools > Site Health > Info > Server. The PHP version
   is listed right there.
   -

   Hosting control panel such as cPanel: look for “Select PHP Version” or
   “MultiPHP Manager.”

Both are just point-and-click menus, no commands required.

4. Where is it hosted?

   -

   It probably needs action if: You pay a hosting company like GoDaddy,
   Bluehost, SiteGround, or HostGator, or the site runs on a server in your
   lab. Shared hosting very commonly uses PHP, so contact the host or check
   your control panel.
   -

   It is likely not affected or is being managed for you if: The site is
   built on a fully managed platform like Google Sites, Squarespace, or Wix,
   or is managed by ITS. The provider handles PHP, if it’s used at all.

5. Ask whoever set it up.

If a former student, postdoc, or vendor built the site, a quick note works:
“Does our site use PHP, and has it received the October 21 security update?”

6. Still not sure?

Ask ITS. Submit a ticket at its.ucr.edu/help with the site’s web address
and "PHP vulnerability concern" in the description. ITS will escalate the
request for immediate support.

Information Technology Solutions

Computing & Communications Building

900 University Ave.

Riverside, CA 92521

951-827-4848 | its.ucr.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://scotmail.ucr.edu/pipermail/ucrfacultyandstaff/attachments/20261022/a0d26297/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image
Type: image/png
Size: 34862 bytes
Desc: not available
URL: <https://scotmail.ucr.edu/pipermail/ucrfacultyandstaff/attachments/20261022/a0d26297/attachment-0001.png>