St. Thomas University Pulls Websites Offline Over Global PHP Flaw

Visitors to St. Thomas University's website on Wednesday got no homepage. They got a single notice: "STU.ca is temporarily unavailable."

"As a precautionary measure in response to a worldwide security vulnerability, the university websites hosted under STU.ca have been temporarily restricted," the St. Thomas University notice says.

The Fredericton university was one of many organizations that went dark on Oct. 21 as administrators rushed to fix two critical flaws in PHP, the language behind a large share of the web. Governments in Canada and Europe took sites offline too.

'Update now'

"If you run PHP, it is imperative that you update now," The PHP Foundation wrote on Wednesday.

The flaws, CVE-2026-109618 and CVE-2026-109619, can let an attacker run code on a server without logging in. The PHP project rates both critical, with a CVSS 4.0 score of 9.2, in its GitHub security advisories.

PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php riskiest: a demonstrated exploit lets one unauthenticated request trigger the attack "before any application code runs."

What STU says

STU's notice says only its public-facing STU.ca websites are affected. SharePoint sites, MySTU, the STUdent Hub and Self Service are still available.

"Our technical teams are assessing the vulnerability and taking appropriate protective measures," the notice says. "Public website access will be restored as soon as it is safe to do so." It gives no timeline.

The university had not posted about the outage on its X account by Wednesday evening.

Leaked before the fix

The fix was supposed to ship on Oct. 22. It came a day early because the flaws leaked.

On Oct. 20, at about 15:00 UTC, the two CVE numbers began circulating on forums and social media with a wrong release time and a wrong severity score of 10.0, the PHP Foundation said. It said no technical details leaked with them. The project moved the release up to Oct. 21.

That evening, one of the security firms that reported the flaws "mistakenly published a video" of its proof of concept, the foundation said, which "contributed to accelerated development" of exploits. The Canadian Centre for Cyber Security says a proof of concept is available, though it has not seen active exploitation "at this time."

Cybersecurity firm Wiz said it found the flaw using artificial intelligence, CBC News reported.

Sites go dark across Canada

Federal Artificial Intelligence Minister Evan Solomon said some Government of Canada websites were taken offline "as a precaution to protect government systems and Canadians' information."

Provincial sites for Newfoundland and Labrador and Prince Edward Island were also offline, showing messages that blamed a global security incident, CBC News reported. The Newfoundland and Labrador notice says sites are being "temporarily taken offline today as a precautionary measure following a newly disclosed global cybersecurity vulnerability."

Elections B.C.'s site was also down on the last day of advance voting before Saturday's provincial election, CBC reported.

Elsewhere in N.B.

STU is the only New Brunswick organization we found that has said the flaw affected its sites.

When we checked at about 7:30 p.m. Atlantic time Wednesday, the main sites for the University of New Brunswick, the provincial government and Elections NB were loading. UNB's news blog, at blogs.unb.ca, would not load for us. Neither UNB nor the province had posted a notice about the flaw on their websites or X accounts.

What admins should do

The Cyber Centre's alert AL26-026 and PHP's advisory say to:

• Update now to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and LTS vendors got the patches in advance, so check for updated packages.
• Move off old versions. PHP 8.1 and older no longer get updates from the PHP project. Ask your vendor about backported fixes, or upgrade to a supported version.
• Start with internet-facing systems and apps that handle untrusted input.
• Find hidden PHP in third-party products, appliances and containers.
• Isolate what you can't patch. If you can't update right away, the Cyber Centre says to consider taking internet-facing apps off public networks until a fix is applied.
• Check for compromise in web server, application, login and endpoint logs.

PHP says workarounds reduce exposure to some attack paths "but do not make an installation safe." Only the update is a complete fix.

Report suspicious activity to the Cyber Centre at contact@cyber.gc.ca.

Sources

• St. Thomas University: STU.ca is temporarily unavailable
• Canadian Centre for Cyber Security: AL26-026, Critical vulnerabilities impacting PHP
• PHP: Security advisory: Critical remote code execution vulnerabilities, update now
• PHP GitHub advisory: RCE via OOM corruption (CVE-2026-109618)
• PHP GitHub advisory: RCE via stale global state (CVE-2026-109619)
• The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security
• CBC News: Canadian government sites among those offline after flaw identified in widely used computer language
• Government of Newfoundland and Labrador: Temporary Disruption to Government Websites and Some Online Services
• Evan Solomon on X