Czech Technical University in Prague (ČVUT) announced on Facebook on 22 October 2026 that it is dealing with a cyberattack on its IT infrastructure. According to the university, the active attack was stopped, but some systems remained shut down as a precaution until a solution is found and operations are restored.[1][2]

Link to a PHP vulnerability

The university said the attack is connected to worldwide attempts to compromise websites that use the PHP programming language, in which critical security flaws were reported. The flaws can allow an attacker to run their own code on a remote server without logging in. The National Cyber and Information Security Agency reported the vulnerability on the social network X on 21 October 2026 and recommended that operators update immediately to the patched version.[1][2]

On the same day, Úřad vlády České republiky took its website offline for about two hours as a precaution, and the Czech Hydrometeorological Institute also took some websites offline. According to the Reuters agency, government offices in Germany, France, the Netherlands and Finland had acted similarly earlier. Taking a website offline does not in itself mean that it was attacked.[1][2]

Details not specified

In its statement, ČVUT did not specify which services the shutdown affects or when they will be available again. It also did not say whether the attackers gained access to student or staff data, or whether the incident disrupted teaching. The school did not disclose the technical nature of the attack or the flaw that was exploited.[2]

Chronology

  • — Hackers attacked the Czech Technical University in Prague, which shut down part of its systems as a result. ČTK / České noviny Novinky.cz

Sources

  1. ČTK / České noviny — 22 October 2026
  2. Novinky.cz — 22 October 2026