2026 年 10 月 23 日
依據 PHP 原廠及數位發展部資通安全署於 2026 年 10 月 21 日發布之最新安全公告，網站開發語言 PHP 發現兩項重大資安漏洞（編號：CVE-2026-109618 及 CVE-2026-109619，CVSS v4.0 風險評分達 9.2 分）。未修補之受影響系統可能遭攻擊者透過網路遠端執行惡意程式碼，威脅伺服器及網站安全。
一、影響範圍說明
- 此漏洞屬於網站與伺服器底層系統風險，並非個人電腦所使用的 Windows/macOS 作業系統或 Office（Word、Excel 等）文書軟體漏洞，同仁日常辦公設備無需擔憂。
- 各單位或教師個人（含實驗室、研究計畫）若有自行架設、委外維運之網站、內容管理系統（CMS）或伺服主機，請務必配合進行清查與修補作業。
二、應辦理之補救措施
- 清查所屬單位或研究室架設之網站、委外維護系統及伺服器是否採用 PHP，並確認目前運作版本。
- PHP 原廠已釋出修補版本（包括 PHP 8.5.12、4.27、8.3.36 及 8.2.35）。請配合主機作業系統與套件管理工具儘速升級；若仍使用已終止支援之舊版本，應儘速規劃升級至受支援版本。
- 若系統委由外部廠商維護，請管理人員主動洽詢廠商確認系統架構、受影響情況及預計修補期程，並追蹤完成進度。
- 完成修補後，請檢視系統存取紀錄（Logs），確認近期是否有異常連線或可疑操作。如發現疑似遭入侵跡象，請立即檢查帳號與憑證安全，並依校內資安通報程序通報資訊單位。
三、參考資訊：
1.PHP 原廠安全公告：
https://www.php.net/archive/2026.php?fbclid=IwZnRzaAVF0lxleHRuA2FlbQIxMQBwZG9mBWZkaWQWUQvmzN8MGXVsXD3yfHtd_7Z-CNWyUXNydGMGYXBwX2lkCjY2Mjg1NjgzNzkAAR5vuhv-Hpy_cB5HGtGekK-TWeNjbrFwPW5hV0isZFRm297li6mdB7aaVBLJug_aem_z6xvC9toqQCzC5106eOIsQ#2026-10-21-5
2.網站開發程式語言PHP釋出緊急安全更新 資安署呼籲儘速完成修補：https://moda.gov.tw/ACS/press/news/press/21134
According to the security advisories issued by the PHP development team and the Administration for Cyber Security (ACS), Ministry of Digital Affairs, on October 21, 2026, two critical vulnerabilities have been identified in PHP, a programming language commonly used for website development. The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 severity score of 9.2. Unpatched affected systems may allow attackers to remotely execute malicious code over a network, posing a threat to server and website security.
I.Scope of Impact
- These vulnerabilities affect the underlying software environments of websites and servers. They are not vulnerabilities in the Windows/macOS operating systems or Microsoft Office applications (e.g., Word and Excel) commonly used on personal computers. Faculty and staff do not need to take action on their everyday office computers solely because of this alert.
- Any department or faculty member who operates a self-hosted or externally maintained website, content management system (CMS), or server, including those used by laboratories or research projects, must check for potential exposure and carry out the necessary remediation.
II.Required Remediation Measures
- Check whether websites, externally maintained systems, and servers operated by your department or research lab use PHP, and verify the versions currently in use.
- PHP has released patched versions, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Please upgrade to the appropriate version as soon as possible, taking into account the host operating system and package management tools. If an end-of-life version is still in use, plan an upgrade to a supported version as soon as possible.
- If a system is maintained by an external vendor, contact the vendor to confirm the system architecture, whether the system is affected, and the expected remediation schedule. Follow up to ensure that remediation is completed.
- After applying the patches, review system access logs for unusual connections or suspicious activities. If there are signs of a possible compromise, immediately check the security of relevant accounts and credentials, and report the incident to the Information and Network Technology Division in accordance with the university’s cybersecurity incident reporting procedures.
III. References
1.PHP Official Security Advisory
https://www.php.net/archive/2026.php?fbclid=IwZnRzaAVF0lxleHRuA2FlbQIxMQBwZG9mBWZkaWQWUQvmzN8MGXVsXD3yfHtd_7Z-CNWyUXNydGMGYXBwX2lkCjY2Mjg1NjgzNzkAAR5vuhv-Hpy_cB5HGtGekK-TWeNjbrFwPW5hV0isZFRm297li6mdB7aaVBLJug_aem_z6xvC9toqQCzC5106eOIsQ#2026-10-21-5
2.Administration for Cyber Security, Ministry of Digital Affairs: https://moda.gov.tw/ACS/press/news/press/21134