AAF Support

The AAF Support desk is monitored Monday to Friday 8am – 4pm AEST

AAF Support Drop-In Session - Got a Question? Book Here

Updates


Shibboleth V5 AAF Support

Time to start planning your Shibboleth IdP upgrade. The current stable release of the Identity Provider is V5.1.6 and the previous stable release is V4.3.3. 

For users of AAFs RapidIdP hosted IdP solution there is nothing to do, the AAF will upgrade your IdP with zero downtime. Click here more information about RapidIdP.

We will be in contact with all non-RapidIdP subscribers to discuss your upgrade plans. 

The Shibboleth IdP V4 software will leave support on September 1, 2024. 

If you have any questions or would like assistance upgrading your IdP please contact us at support@aaf.edu.au.
Top 5 Trust and Identity Themes Survey 2026 AAF Support

AAF’s Top Five Trust and Identity Themes for Australia’s Higher Education and Research Sector outlines the most critical priorities shaping this domain for sector leaders.

This discussion paper captures key insights from the 2025 Advancing Trust and Identity in Higher Education and Research Roundtable, held alongside the CAUDIT Spring Meeting and AHECS Cybersecurity Summit. 

The session brought together senior leaders from across universities and national research infrastructures, and we would like to hear from you.

https://aaf.edu.au/project/aaf-top-five-theme-2026-survey/?mc_cid=a66c3b6a25&mc_eid=4b6bc867f0
PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) AAF Support

On 21 October 2026, PHP released fixes for two critical vulnerabilities that can allow remote code execution without authentication. They affect PHP 5.4 and later.
  • Rapid IdP does not use PHP and is not affected.
  • AAF services that use PHP have been patched, or taken offline until they are.
  • We will update this page if anything changes.


What should you do?
If any of your services run PHP, update to a fixed version as soon as possible: PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your operating system vendor’s patched package. Restart PHP and your web server after updating. This includes:
  • SimpleSAMLphp identity and service providers
  • Moodle, Drupal, WordPress and other PHP applications connected to the federation


PHP 8.1 and older will not receive an official fix. Upgrade them, or remove them from the internet until you can.

Shibboleth does not use PHP, but the application behind a Shibboleth SP might, so please check it too.

If you need help, or find signs of compromise affecting your federation services, contact support@aaf.edu.au.

Newsletter Sign-up

To receive regular updates from AAF:

Add Me to the General List or Add Me to the Technical List or Add Me to the ORCID mailing list