PHP Vulnerability Responses by Company

Public Knowledge Project

Global hosting
Aliases / services
Public Knowledge Project / PKP / PKP Publishing Services / OJS / Open Journal Systems / Open Monograph Press / Open Preprint Systems / pkp.sfu.ca
Official website
https://pkp.sfu.ca/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

PKP Publishing Services (hosted journals)

Response status
Upgrades announced; completion not listed
Response information checked
2026-10-24

Current re-audit: Source inaccessible; on hold · Research date: 2026-10-27

A Canada-based provider of scholarly publishing software and hosting.

An October 21 PKP staff announcement said PHP upgrades for hosted journals were being completed and brief downtime was possible. A subsequent confirmation that all affected upgrades finished has not been verified.

Scope: This covers PHP infrastructure for PKP-managed hosted journals. The advisory concerns PHP, not a vulnerability in OJS, OMP or OPS themselves; self-managed installations require different action.

Some official sources could not be retrieved. Reverification remains on hold and the previous verification date is retained.

What users should do

The announcement says hosted-journal customers do not need to take action. Confirm the current deployment status with PKP notices or support.

Official service URL

Source URLs

  1. https://forum.pkp.sfu.ca/t/critical-php-rce-cve-2026-109618-and-cve-2026-109619/98970https://forum.pkp.sfu.ca/t/critical-php-rce-cve-2026-109618-and-cve-2026-109619/98970Response evidence
  2. https://www.sfu.ca/publishing/news/news-announcements/MPub-Alumni-Share-Their-Experience-of-Working-with-the-Public-Knowledge-Project.htmlhttps://www.sfu.ca/publishing/news/news-announcements/MPub-Alumni-Share-Their-Experience-of-Working-with-the-Public-Knowledge-Project.htmlService and operation documentation
  3. Emergency PHP updates for PKP hostinghttps://forum.pkp.sfu.ca/t/pkp-websites-downtime-php-emergency-security-fixes-october-21-2026/98976Response evidence
  4. https://forum.pkp.sfu.ca/https://forum.pkp.sfu.ca/Service and operation documentation

OJS, OMP and OPS (self-managed)

Response status
User PHP update required
Response information checked
2026-10-24

Current re-audit: Source inaccessible; on hold · Research date: 2026-10-27

On October 21, PKP staff advised operators of self-managed installations to ask their host or IT team to apply PHP fixes. The corrected releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Scope: This covers the PHP runtime of self-managed OJS, OMP and OPS installations, with different responsibility from PKP-hosted journal upgrades.

Some official sources could not be retrieved. Reverification remains on hold and the previous verification date is retained.

What users should do

Update the deployment's PHP runtime and confirm application with the host or IT team. Updating OJS or another application alone does not replace patching PHP.

Source URLs

  1. https://forum.pkp.sfu.ca/t/critical-php-rce-cve-2026-109618-and-cve-2026-109619/98970https://forum.pkp.sfu.ca/t/critical-php-rce-cve-2026-109618-and-cve-2026-109619/98970Response evidence
  2. https://www.sfu.ca/publishing/news/news-announcements/MPub-Alumni-Share-Their-Experience-of-Working-with-the-Public-Knowledge-Project.htmlhttps://www.sfu.ca/publishing/news/news-announcements/MPub-Alumni-Share-Their-Experience-of-Working-with-the-Public-Knowledge-Project.htmlService and operation documentation
  3. Emergency PHP updates for PKP hostinghttps://forum.pkp.sfu.ca/t/pkp-websites-downtime-php-emergency-security-fixes-october-21-2026/98976Response evidence
  4. https://forum.pkp.sfu.ca/https://forum.pkp.sfu.ca/Service and operation documentation
Related official sources
  1. Emergency PHP updates for PKP hostingOfficial notice

Comments