CUNY Academic Commons

Hi All,

The admin of the ACERT site, hosted on commons and mapped to a hunter domain(acert.hunter.cuny.edu)received this message from their IT department.

Can you all help decipher this? Is it related to the PHP issues of the last few weeks? Does the Commons team need to fix anything and/or can we provide guidance to the ACERT admin on how to respond?

From: Adeoye Elemide <Adeoye.Elemide@hunter.cuny.edu>
Date: Tuesday, November 3, 2026 at 11:15 AM
To: Jacob Radford <jradford@hunter.cuny.edu>, Julie Van Peteghem <jv41@hunter.cuny.edu>
Cc: Michael D'Amico <mdami@hunter.cuny.edu>
Subject: Action Required: Secure Publicly Accessible phpMyAdmin Login Page Within 14 Days

Good morning, Jacob and Julie Van Peteghem,

We identified a publicly accessible phpMyAdmin database administration login page at https://acert.hunter.cuny.edu:8443 yesterday.

Today, it shows the site can’t be reached. Not sure if a change was made from your end.

The alert still shows in Cortex Xpanse.

This exposure allows external actors to attempt brute-force and credential-based attacks, potentially resulting in unauthorized access to the underlying databases if successful.

As requested by the CISO, please secure this interface within 14 days of this notification. Access should be restricted to authorized administrators through a VPN, approved IP allowlist, or equivalent access controls. If the interface is no longer needed, please disable or remove it.

Please also ensure that phpMyAdmin is running a supported, patched version and that appropriate authentication protections and login monitoring are in place.

I have created the ticket – INC0595137 to track the remediation.

Kindly acknowledge receipt and provide your planned remediation date. Once completed, please confirm the changes so the Cybersecurity team can validate that public access has been appropriately restricted. If you anticipate any difficulty meeting the deadline, please notify us promptly.

Thank you for your cooperation.