PHP Remote Code Execution Vulnerability Response

On October 21st, 2026 a pair of vulnerabilities in PHP covering all deployed versions of PHP going back several years was disclosed. If you are seeing this page then you have attempted to access a site affected by these vulnerabilies.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The following sites/services are unaffected and are still available at their original URL's:

The following University of Utah Health Science Cores sites utilize affected versions of PHP and are currently offline:

A review of the site logs by Cores IT shows no signs of compromise at this time but out of an abundance of caution we will be disabling the sites listed above until patches are available and have been deployed for the affected sites. We anticipate that patches for Wordpress based sites will be available in the next few hours or days. Other sites will be patched as available.

If you need assistance with Billing or other administrative matters please contact the admin office at billing@cores.utah.edu. For technical issues with the Resource, Inventory, or BOS systems please contact help@cores.utah.edu

For additional information about these vulnerabilities please see the following security advisories: