What The University Announced
On October 21, 2026, the Federal University of Campina Grande (UFCG) in Brazil announced temporary restrictions on external access to institutional systems that rely on PHP. Its technology service cited two recently disclosed critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and said outside access would stay limited until security fixes could be installed and validated. The institution described the restrictions as preventive measures to protect systems and users rather than confirmation of a successful attack.
Which Services Were Affected
The university identified SEI, GLPI, Moodle and OJS among systems impacted by the temporary policy, alongside other services using PHP. The SEI administrative system was unavailable from the public internet starting on October 21, while internal network access remained possible for certain services. External users could request VPN access through the university IT service where appropriate. The announcement also warned that users without university credentials might temporarily lose access until remediation checks were completed.
Why The Php Vulnerabilities Matter
The two vulnerabilities involve potentially unauthenticated remote code execution in affected PHP environments. PHP is a common component in application stacks, so organisations may rely on it through several separate products. Identifying the affected dependency and updating only one application may not resolve exposure elsewhere. This is why the university's response focused on restricting internet reachability while it assessed and updated individual services.
What Administrators Can Learn
Inventory externally accessible applications and the runtime versions behind them. If an affected service cannot immediately be patched, coordinate temporary restrictions or isolation with service owners, while preserving essential business processes. Communicate clearly with users about which systems are affected, what alternative access methods exist and how to obtain reliable status updates. After patching, validate that application functions and security checks work before restoring broad external access.
What Is Confirmed And Unknown
The primary source confirms the university's access restrictions and its stated reason, not any compromise of UFCG systems. CyberGeek News has not independently verified how long each restriction remained in place after the notice or the status of every application today. Readers should consult the university's own subsequent service bulletins.