URGENT: Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) – action required

Dear customer,

The PHP project has announced two critical vulnerabilities in PHP. They are tracked as CVE-2026-109618 and CVE-2026-109619 and rated CVSS 9.2. Both allow remote code execution, and an attacker does not need to log in. PHP is attacked while it reads the incoming request, before any application code runs, so application-level protections do not help. Details leaked before disclosure.

Some security researchers report attacks are already happening; others have not seen any yet. The fixed releases are scheduled for 21 October 2026, 14:00 UTC. According to reports, every version from PHP 5.4 onward is affected. Official fixes are only provided for PHP 8.2 and later.

What we ask you to do (if you run PHP):

  1. Update PHP immediately once the fixed releases are out, on every system that runs PHP.
  2. Rebuild and redeploy all container images that include PHP. This covers official php:* images, images based on them, and any image that installs PHP. A running container stays vulnerable until it is rebuilt from a patched base image and redeployed. Patching the host does not fix it.
  3. Plan an upgrade for PHP 8.1 and older. These versions will not get an official fix.
  4. If you use the Remi repository (rpms.remirepo.net): Remi has said it will not publish updates on 21 October. Switch to your distribution’s packages or contact us.
  5. If you cannot patch right away: temporary measures include blocking multipart/form-data requests at the web server (this breaks file uploads), a WAF with current rules, or taking the affected sites offline. These are stopgaps only.

We are checking the systems we manage and will patch them. Please tell us about any systems or images you maintain yourself.

Best regards,

Your CONVOTIS Deutschland Managed Services Team