Beta Branch add critical PHP CVE-2026-109618/109619 SSH login notice in 140.00beta01

add critical PHP CVE-2026-109618/109619 SSH login notice in 140.00beta01

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix two critical unauthenticated
RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The SSH login
banner now warns on every server whose PHP is not fixed, independent of
DMOTD_PHPCHECK and the other PHP notice toggles.

Changes:
- config/motd/dmotd.sh: new php_cve_2026_109618_status() decides from
php-config --version. PHP 8.2.35+, 8.3.36+, 8.4.27+, 8.5.12+ and 8.6+
are fixed. PHP 7.4.33, 8.0.30 and 8.1.34 are fixed only when the
patch_php log of the build that installed php-fpm (the newest log not
newer than /usr/local/sbin/php-fpm) shows the <x.y>-cve-2026-109618
patch applied. PHP 7.3 and older are end-of-life with no fix
- config/motd/dmotd.sh: new php_cve_2026_109618_check() prints a short
critical notice after the cmsec kernel CVE lines with the cmupdate and
centmin.sh menu option 5 steps and a link to
https://community.centminmod.com/threads/33134/
- config/motd/dmotd.sh: push_dmotd_alerts() gains a phpcve case that
uses the CVE Pushover cooldown and critical priority settings, one
alert per PHP version per cooldown window
- config/motd/dmotd.sh: new DMOTD_PHPCVE_2026_109618='y' default, set
it to 'n' in /etc/centminmod/custom_config.inc to silence the notice
- example/custom_config.inc: document DMOTD_PHPCVE_2026_109618

Continue reading...

---

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01