Critical PHP vulnerabilities: what do they mean for journals using OJS?

Recent vulnerabilities discovered in PHP have highlighted the importance of keeping the technology infrastructure of scholarly journals up to date.

On 21 October 2026, fixes were released for two critical flaws that could allow remote code execution on certain servers. The news is particularly relevant for journals that use Open Journal Systems (OJS), a PHP-based editorial management platform.

Although these vulnerabilities are not specific to OJS, they raise an important question: who is responsible for keeping editorial platforms secure?

What is PHP and what has happened?

PHP is a programming language used by many web applications and platforms, including OJS.

The two vulnerabilities, rated 9.2 out of 10 for severity under the CVSS system, could allow an attacker to execute code remotely under certain conditions.

In response to this risk, bodies such as CERT-EU recommended identifying affected systems and applying the available security updates.

This does not mean that every PHP installation is vulnerable. The risk depends on the version in use and the server configuration.

How could these vulnerabilities affect Open Journal Systems (OJS)?

OJS is an open-source platform developed by the Public Knowledge Project (PKP) to manage the submission, review and publication of scholarly articles.

Because it runs on PHP, installations using vulnerable versions may be affected even if OJS itself is up to date.

It is important to distinguish between a vulnerability in OJS and a security issue in the infrastructure it runs on. A journal’s security therefore depends both on the editorial platform and on the maintenance of its technical components.

Technology maintenance: a challenge for academic journals

At Index we work with university journals, scholarly societies and editorial teams with very different resources. Some publications have specialised IT departments, while others rely on external providers or small teams.

In every case, it is necessary to ensure continuity of service, protect personal data and preserve the confidentiality of manuscripts and review reports.

This requires keeping editorial software, programming environments, databases and other infrastructure components up to date.

What should journals using OJS check?

The main recommendation is to review the state of the installation together with the technical team or provider responsible for it. In particular, it is worth checking:

• PHP version: verify that the server is running a patched version or has the corresponding security fixes applied.
• OJS updates: keep the platform and its plugins on compatible, supported versions.
• Maintenance responsibility: identify who monitors vulnerabilities and applies updates.
• Backups: check that they are made regularly and can be restored.
• Access security: review permissions, administrator accounts and authentication mechanisms.
• Incident response: have a procedure in place for when a security problem is detected.

Given the recent vulnerabilities, the priority is to apply the PHP fixes as soon as possible.

Managed editorial platforms: another way to approach technology

Journals can manage their technology infrastructure directly or delegate this responsibility to a specialised provider.

While open-source solutions such as OJS offer extensive control over the system, Software as a Service (SaaS) models include infrastructure management, maintenance and updates.

Although no model completely eliminates security risks, delegating these tasks can reduce the technical burden on editorial teams, especially when they lack their own IT resources.

The Index approach: technology and editorial support

At Index we have developed our own platform that brings together the main stages of managing and publishing scholarly journals.

Our model lets journals delegate technology maintenance to a specialised team and focus their resources on their editorial processes.

In addition to manuscript management and peer review, we offer article production in PDF, HTML and JATS XML, DOI management, content publishing and indexing advice.

We also support journals that wish to migrate from OJS or other platforms, taking care to preserve their content and metadata.

Our goal is for technology to make editorial work easier, without adding technical responsibilities that are hard to take on.