Updates Following Worldwide PHP Security Flaw – Thurs., 10/22
The following information relates to a global cybersecurity incident affecting websites and services beyond UC Davis.
A critical security flaw has been found in PHP, a programming language that powers a large share of websites and services, including many at UC Davis. It is estimated that 70% of websites worldwide have been impacted. The flaw lets attackers take control of a website or service without needing to log in.
At UC Davis, campus websites using SiteFarm and Faculty sites have already been patched.
Information for the UC Davis Community
- Your device is not the main target. However, since this incident likely will lead to some compromised websites, be extra vigilant for unexpected redirects, websites unexpectedly asking for sensitive information and other signs that a website may have been maliciously modified.
- Some websites may be offline. The FBI is urging organizations that cannot patch right away to take affected sites offline temporarily.
- Watch for phishing and practice digital safety. Use trusted websites, be extra wary of suspicious messages after visiting websites, enable two-step login when available and do not ignore warnings from your web browser about insecure websites.
Information for Website & Service Owners
- If you manage a website, web server or other service that uses PHP, you must update PHP with urgency. Learn more about PHP vulnerabilities.
- If someone else hosts or manages your site, contact them today to confirm they have applied the update.
- If you don’t have a support team and are not sure what to do, email [email protected].
- If the website or service cannot be updated for any reason, please take it offline.
What you need to do
If you run your own website or server:
- Update PHP to one of these versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Watch for further updates, as the situation may change.
If someone else hosts or manages your site:
- Ask your support team or vendor whether they’ve updated PHP.
- Confirm they’re watching for further developments.
Important: These fixes were released on October 21, 2026. Any PHP updates made before that date do not fix this problem.
The PHP development team, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and security experts around the world are urging everyone who runs PHP-based websites to update immediately. As AI tools have been used, vulnerable sites could be found and attacked much faster than in the past.