On 21 October 2026, PHP released fixes for two critical vulnerabilities that can allow remote code execution without authentication. They affect PHP 5.4 and later.
- Rapid IdP does not use PHP and is not affected.
- AAF services that use PHP have been patched, or taken offline until they are.
- We will update this page if anything changes.
What should you do?
If any of your services run PHP, update to a fixed version as soon as possible: PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your operating system vendor’s patched package. Restart PHP and your web server after updating. This includes:
- SimpleSAMLphp identity and service providers
- Moodle, Drupal, WordPress and other PHP applications connected to the federation
PHP 8.1 and older will not receive an official fix. Upgrade them, or remove them from the internet until you can.
Shibboleth does not use PHP, but the application behind a Shibboleth SP might, so please check it too.
If you need help, or find signs of compromise affecting your federation services, contact support@aaf.edu.au.
