PHP security measures impact 960 student tests

On Wednesday afternoon, the university took websites offline as a precaution because of two serious PHP vulnerabilities. As a result, the websites of TU/e and Cursor, among others, were temporarily unavailable. Websites of several companies, municipalities, educational institutions, and other organizations were also taken offline as a precaution.

Additional information provided by TU/e now shows that the impact on education and research remained limited. However, students from the departments of Mathematics & Computer Science (M&CS) and Chemical Engineering & Chemistry (CE&C) were temporarily unable to take digital midterm tests on Wednesday afternoon and Thursday morning. This included Calculus tests.

For these tests, students can decide themselves when to take or retake an exam. Students who had scheduled a test on Wednesday afternoon or Thursday morning were therefore affected. In totaal gaat het om zes sessies waaraan telkens 160 studenten deel konden nemen. Al die sessies waren volgeboekt. The tests have been available again since Thursday afternoon. According to TU/e, discussions are underway with the lecturers and examination committees involved to determine whether any additional measures are needed.

Researchers

Researchers also experienced the effects of the precautionary measures. Applications and websites were no longer accessible from Wednesday afternoon because network ports had been closed. Researchers who use their own infrastructure were required to install updates before regaining access to the network.

For most staff members, the impact remained limited. On campus, regular computer systems and office applications continued to be available. Staff working from home or at external locations had to use a VPN connection for certain applications.

No indications of a hack

TU/e says it deliberately chose to keep its internal systems largely operational. Outbound traffic from the campus network remained possible, while access from outside the network was only permitted through a VPN connection.

According to the university, there are currently no indications that hackers gained access through the PHP vulnerabilities. Additional measures are nevertheless being taken. TU/e says it will further expand its security monitoring so that risks can be identified at an earlier stage in the future.

This article was translated using AI-assisted tools and reviewed by an editor.