A critical security vulnerability occured in the PHP programming language.
Vulnerability in PHP
RUB Websites Temporarily Blocked from External Access
Due to a security vulnerability in PHP, access to the RUB websites from outside the university was blocked on October 21 as a precautionary measure. The systems are now being reactivated step by step.
Update from October 22, 2026, 4.30 p.m.
Information for administrators of decentralized systems: Decentralized systems will not be automatically restored. Administrators or operators of such systems must first report that the systems have been patched or were not affected—even if they run on servers hosted by IT.Services.
The form for this notification will be published in the afternoon of October 22. Updates will be provided via the network administrator chat, the network administrator mailing list, and the website https://www.informationssicherheit.ruhr-uni-bochum.de/is/news/meldung00051.html.de.
Update from October 22, 2026, 1.10 p.m.
The systems are now being reactivated step by step.
Update from October 22, 2026, 11.05 a.m.
The first central systems have been successfully updated. Additional updates are currently being deployed. Each service is tested after update installation and then activated again. Administrators of decentralized systems will be able to use a centrally provided form to report which of their systems have been updated or are not affected so that they can be activated. They will receive specific instructions on how to do this.
Update from October 21, 2026, 4.45 p.m.
First patches published by the PHP project are now available and will be installed as soon as possible at Ruhr University Bochum.
Original news from October 21, 2026, 12.35 p.m.
Due to a critical security vulnerability in the PHP programming language, we are temporarily blocking external access to the websites of Ruhr University Bochum. This measure will be in effect starting October 21, 2026, at 12:30 p.m. and is expected to last until October 22, 2026, at 12 p.m. (CEST).
Access within the RUB network (i.e., on campus or via a VPN connection) remains unrestricted. The vulnerabilities affect not only Ruhr University Bochum but all PHP-based web applications worldwide. They could allow attackers to execute code remotely. Therefore, Ruhr University Bochum is taking precautionary security measures.
The PHP Project has announced a patch for the security vulnerabilities for October 21 at 4 p.m., which will be immediately tested and deployed at Ruhr University Bochum.
We will publish further information as needed at:
https://notfall.ruhr-uni-bochum.de/en/emergency-webpage-of-ruhr-university-bochum/