PHP Vulnerabilities – Systemwide Response

CTS is actively responding to the current critical PHP vulnerabilities affecting web systems. We have identified affected systems within the CTS environment and are continuing to assess exposure and remediation options. The applicable updated packages are not yet available in the Red Hat Enterprise Linux (RHEL) repositories used by our systems. Until they become available, CTS is taking temporary measures to reduce exposure.

Our current approach for CTS-managed systems is:

• We will check for and deploy applicable patches daily beginning at 7:00 p.m. as they become available.
• For affected external-facing systems that remain unpatched, we will restrict access to STAGEnet from 9:00 p.m. to 7:00 a.m. daily until they are patched.

Non-subscribed Components Affected:

• tiny.ndus.edu
• Various WordPress Multisites
• Staff and Student Senate Sites