What is Happening?

Newly identified safety flaws have been discovered in PHP—the underlying engine that powers a massive portion of the web, including publishing tools like WordPress, Drupal, and custom site platforms. If left unaddressed, these flaws allow unauthorized users to disrupt web pages, leak sensitive data, or take control of affected web systems.

For technical details, view the officialPHP Security Announcements.

What DoIT & Third-Parties Are Doing

• DoIT Managed Systems: DoIT is actively working to apply necessary security updates across DoIT-managed web infrastructure as they become available. 

• External Hosting Providers: Many major third-party web hosts (such as Pantheon) have already begun rolling out automatic updates and security fixes across their platforms.

• Potential Website Disruption: Because web administrators globally are patching systems or temporarily taking pages offline to safeguard them, you may notice temporary outages or brief site downtime across various web services today.

What You Need to Do

1. Check Departmental Sites: Identify any web pages, forms, or tools managed directly by your team or external vendors.

2. Apply Updates: If you manage your site software, add-ons, or building tools independently, apply any pending updates as soon as possible. Learn more at the official PHP download page. 

3. Report Issues: If you spot anything unusual or experience unexpected downtime on your web pages, let us know right away at security@umbc.edu.

Need Help?

If you have questions about your website or need assistance, contact security@umbc.edu.

Thank you all for your continued awareness and assistance in keeping our community secure.

Cybersecurity Assurance and Digital Trust
UMBC Division of Information Technology (DoIT)