On Tuesday, October 20, 2026, various researchers and organizations disclosed critical cybersecurity vulnerabilities in a programming language, PHP, that powers many websites and web applications around the world. News organizations have been covering the issue today.
The Information Security Office (ISO), University Information Technology teams, University of Utah Health’s Information Technology Services (ITS) group, and university IT staff are actively monitoring university systems and applying required updates as soon as they become available. Standard computer use is not impacted at this time.
Required actions by role
Faculty, staff, clinicians, and students: No action is required for standard, daily computer use.
System administrators and web managers: If you manage or host web servers, web applications, or custom web applications that run PHP, please ensure your environments are running the latest vendor or developer supplied IT security patches. Technical details and guidance for system administrators and web managers can be found in the Vulnerability Management Microsoft Teams General channel.
If you manage a server or application that runs PHP and need guidance on applying IT security updates, or if you have questions regarding this advisory, please contact your respective help desk: UIT Help Desk at 801-581-4000; ITS Service Desk at 801-587-6000.
Thank you for your partnership in maintaining a secure research, clinical, and academic environment. Additional updates will be provided as needed.
Interim Chief Information Security Officer
University of Utah and University of Utah Health
