PHP critical RCE vulnerabilities (CVE-2026-109618 / CVE-2026-109619) #8256

Two critical PHP bugs allow remote code execution without logging in. Exploit code is public. See the PHP security advisory of 2026-10-21.

• CVE-2026-109618, RCE via OOM corruption: an out-of-memory error can stop PHP while request data is only half set up. Request cleanup then uses the broken data.
• CVE-2026-109619, RCE via stale global state: state from a freed request can be reused by the next request in the same worker. The session upload progress handler is one confirmed path.

All PHP web setups are affected: PHP-FPM, Apache mod_php (highest risk), php-cgi.

Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 7.4, 8.0 and 8.1 get no official release. The PHP team only published source backports for them (PHP-7.4-CVE-2026-109618-109619, PHP-8.0-..., PHP-8.1-... branches in php-src).

This issue tracks all NethServer 8 applications that run PHP, in two scenarios:

1. Update: a fixed PHP exists for the branch. Rebuild on it and release. This is the only full fix.
2. Mitigate: no fixed PHP is available (PHP 7.4, 8.0, 8.1, or an upstream image not yet patched). Mitigations reduce exposure but do not make the application safe.

session.upload_progress.enabled = Off stays in every application in both scenarios. None of the applications below use this feature, and it does not conflict with the fix.

Steps to reproduce

• Install one of the applications listed below
• Inside its PHP container run php -v and php -i | grep upload_progress.enabled

Expected behavior

• Scenario 1: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, and session.upload_progress.enabled => Off => Off
• Scenario 2: the mitigation settings below are active, and the user is told to move to a supported PHP version

Actual behavior

Vulnerable PHP version (8.4.26 in the Nextcloud and Roundcube images, 8.5.4 in Piler). Upload progress was already turned off in some applications (see below).

Scenario 1: update

Bump the base image or PHP packages, rebuild, release.

• Nextcloud: 8.4.26 → 8.4.27 (mitigation already in 1.7.6, fix(php): disable session upload progress ns8-nextcloud#279)
• Roundcube: 8.4.26 → 8.4.27 (mitigation already in fix(php): disable session upload progress ns8-roundcubemail#145)
• Piler: 8.5.4 → 8.5.12 resolute-20261006 is still PHP 8.5.4 (cli) (built: Oct 19 2026 14:35:18) (NTS). Piler is mitigated for now and the ubuntu team has patched the CVE
• Porthos (mitigation already in fix: reject request bodies sent to PHP ns8-porthos#34)
• NethVoice: FreePBX and Tancredi (mitigation in release 1.7.14)

Scenario 2: mitigate

Put the settings in php.ini, the FPM pool (php_admin_value / php_admin_flag) or the Apache config, so they apply before the request is read. Do not use ini_set() or .user.ini. Restart all workers.

Always:

session.upload_progress.enabled = Off
; PHP 8.5 only
fatal_error_backtraces = Off

Where the application allows it:

• post_max_size = 8M if the application needs no file uploads, 32M if it does. Keep upload_max_filesize below it.
• memory_limit = -1 only if the container has a memory limit. Without one, a single request can use all the node memory. Not applied by default.

Applications:

• WebTop: fix(php): disable session upload progress ns8-webtop#327, fix(php): harden PHP settings in all containers ns8-webtop#329, fix(php): mitigate PHP RCE bugs in FPM containers ns8-webtop#330 (released in 1.5.16)
  • Phonebook and Apache containers: check PHP version and apply the same settings

Forge applications (lower priority)

Same two scenarios.

Scenario 1, update:

• WordPress
• Passbolt
• DokuWiki
• Web server: PHP-FPM images 8.2, 8.3, 8.4, 8.5
• LAMP: rebuild on patched distribution packages
• LDAP Account Manager: when the upstream image is patched
• MariaDB (phpMyAdmin): when the upstream image is patched
• Wordpress

Scenario 2, mitigate:

• Web server: PHP-FPM images 7.4, 8.0, 8.1. Turn off upload progress by default in the pool; users can turn it back on in their .custom pool file. Tell users to move to PHP 8.2 or later. Optionally, build these images from the php-src backport branches.
• LDAP Account Manager: until the patched upstream image is out
• MariaDB (phpMyAdmin): until the patched upstream image is out

NethServer 7

No fixed PHP exists for the NS7 runtimes (PHP 5.4, 5.6, 7.2, 7.3, 8.0), so only scenario 2 applies. All PRs (branch php_mitigation, php_mitigation_2 for Roundcube) were tested on a NS7 machine. Besides session.upload_progress.enabled = Off, NS7 also gets:

• Apache rejects multipart requests without a Content-Length (chunked), which skip the post_max_size check (GHSA-w8hw)
• pm.max_requests = 1 in every PHP-FPM pool, and one request per process in Server Manager, to break the same-worker chain (GHSA-6wmf)

Tell users to move to NethServer 8: this is a mitigation only.

• System PHP 5.4 (mod_php: Roundcube 1.4, Server Manager, CGP, Samba audit, virtual hosts on the default PHP): fix: mitigate PHP CVE-2026-109618/109619 nethserver-php#4, released in nethserver-php-1.3.1
• PHP 7.2 runtime and virtual hosts: fix: mitigate PHP CVE-2026-109618/109619 nethserver-rh-php72-php-fpm#6, released in nethserver-rh-php72-php-fpm-1.1.2
• PHP 7.3 runtime and virtual hosts: fix: mitigate PHP CVE-2026-109618/109619 nethserver-rh-php73-php-fpm#1, released in nethserver-rh-php73-php-fpm-1.0.1
• PHP 8.0 runtime and virtual hosts: fix: mitigate PHP CVE-2026-109618/109619 nethserver-remi-php80-php-fpm#2, released in nethserver-remi-php80-php-fpm-1.0.1
• FreePBX / NethVoice (PHP 5.6): Mitigate PHP CVE-2026-109618/109619 nethserver-freepbx#86, released in nethserver-freepbx-14.3.4
• Nextcloud (PHP 8.0; limits already 8M/2M, README note): Document PHP upload limits, one request per FPM worker nethserver-nextcloud#163, released in nethserver-nextcloud-1.22.7
• WebTop, Z-Push, WebDAV (PHP 7.3): Limit PHP-FPM workers to one request nethserver-webtop5#145, released in nethserver-webtop5-1.8.22
• Roundcube 1.6 (PHP 7.3): Serve one request per PHP-FPM worker nethserver-roundcubemail-next#12 (README note in Document 32MB cap for PostMaxSize nethserver-roundcubemail-next#11), released in nethserver-roundcubemail-next-1.5.9
• Virtual hosts PHP-FPM pools: Serve one request per PHP-FPM worker in virtual hosts nethserver-httpd#94, released in nethserver-httpd-3.12.4
• Server Manager (MaxConnectionsPerChild 1, KeepAlive Off): fix: one request per httpd-admin process nethserver-httpd-admin#41, released in nethserver-httpd-admin-2.7.2

See also

• https://www.php.net/archive/2026.php#2026-10-21-5
• GHSA-w8hw-w9fx-j79w
• GHSA-6wmf-4rv5-p3rp
• https://jackalsyn.com/posts/php-up-2026.html