A critical flaw in one of the web’s most common programming languages made headlines this week. Here is what happened, what it means for scientific and medical meetings, and how CTI has responded.
On 21 October 2026, the team behind PHP, the programming language that powers a large share of the world’s websites, including WordPress, Drupal and countless event and membership portals, released emergency security updates. They fix two critical vulnerabilities, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10 for severity.
In plain language: on an unpatched server, an attacker could send a single, specially crafted web request and run their own code. No password is needed, and it happens before the website’s own software even gets involved. The flaws had been hidden in PHP for many years. Researchers from Wiz, Calif and OpenAI’s Codex Security team found them, and they note that AI tools helped turn the flaws into working attacks. That is a sign of how quickly the security landscape is changing.
Details leaked a day before the planned release, so organizations worldwide had to move fast. Security firms reported early attack attempts but, at the time of writing, no confirmed break-ins.
Why this matters for scientific and medical meetings
A meeting is not just an event. It is a data ecosystem. Over a single congress cycle, the platforms behind it hold:
- Unpublished research: abstracts and late-breaking data that are embargoed until presentation
- Personal data: names, affiliations, contact details and disclosures of submitters, reviewers, speakers and attendees
- Confidential evaluations: peer-review scores and comments
- Commercial information: exhibitor, sponsor and lead-retrieval data
That makes meeting technology an attractive target. A vulnerability like PHP2Shell does not discriminate. It affects any website running an outdated version of PHP, from a society’s membership site to a small registration form built years ago for a satellite symposium.
The real lesson is not about one bug. Meeting organizers typically rely on many vendors and microsites at once. Each of them is part of your security perimeter, and a single unpatched system can put attendee trust and research embargoes at risk.
How CTI responded
Our Cloud Operations team acted as soon as the advance notice appeared. They applied the recommended mitigations across the cOASIS platform and have completed the necessary updates to all applications.
This is how we approach security every day, not only when it makes the news:
- Watch: we monitor security advisories and threat intelligence continuously, so we act on early warnings rather than headlines.
- Shield: web application firewall rules and monitoring help block malicious traffic while permanent fixes are prepared.
- Patch: we keep the platform on supported software versions and apply critical updates quickly, prioritizing internet-facing systems.
- Verify: after every critical update we check that systems are running as expected and review logs for unusual activity.
- Communicate: we keep our clients informed, so you can answer your own members’ and attendees’ questions with confidence.
Because cOASIS brings abstracts, reviews, programs, presentations, exhibitors and the mobile app together on one platform, a fix like this reaches every module at once. Organizers do not have to chase a patchwork of separate tools and vendors.
What you can do now
If you organize meetings:
- List every web property connected to your event: society website, registration, housing, abstract site, microsites, survey tools.
- Ask each vendor directly whether they run PHP and whether they have applied the October 21 updates (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a patched vendor package).
- Look for forgotten sites. Old microsites from past meetings often run outdated software. Take them offline if nobody maintains them.
- Check your own website. If it runs on WordPress, Drupal or Joomla, updating the CMS is not enough. Your hosting provider must update PHP itself.
- Make security part of vendor selection. Ask about patching timelines, monitoring and incident communication before you sign.
If you are a speaker, presenter or attendee:
- Be cautious of unexpected emails asking you to “re-confirm” your submission, registration or payment details. Attackers often exploit news like this with phishing.
- Log in through the link on the official meeting website rather than links in emails.
- Use a unique password for each meeting account.
Built on trust
Science moves forward when people can share their work with confidence. At CTI, protecting that trust for societies, presenters and every attendee is part of how we deliver meetings, not an add-on. PHP2Shell will not be the last alert of its kind, especially as AI speeds up how vulnerabilities are found and exploited. What matters is how quickly and transparently your technology partners respond.
👉 Questions about PHP2Shell or the security of your meeting platform? Contact your CTI Customer Success Manager. We’re happy to help you review your event’s technology landscape.
We share, we learn, we grow—securely.
