CVE-2026-109618 and CVE-2026-109619

Can't even download the packages currently

 

Possible mitigation until the patches come out: Patch your php pre 2026-10-20 – Behind The Console

 

https://www.reddit.com/r/PHP/commen...=web3xcss&utm_term=1&utm_content=share_button

 

CVE-2026-109618 and CVE-2026-109619: What you should do now

I added the following to /etc/centminmod/php.d/b_customphp.ini and restarted php-fpm, but this is only a partial stop gap:

Code (Text):

session.upload_progress.enabled = Off

You also need to block multipart requests using nginx map, as detailed in the article above.

 

This will break a lot of stuff.

 

Yep, so to be safe the only option is to go offline until 2pm UTC.

 

If your sites are behind Cloudflare: Dane Knecht (@dok2001) on X

 

I took the safe route ran
/usr/local/src/centminmod/tools/sitestatus.sh offline mydomain

then shutdown php-fpm I wont be able to fix this until tomorrow my time so though it best to just be safe and close everything down for now

 

Fixes have been released.

PHP

 

And updated my servers...Quick and easy

 

I just saw centminmod back up.

I had run cmupdate and updated php to 8.3.36 already this morning before you took centminmod.com down.

Do I need to do it again since you released new centminmod versions?

In https://community.centminmod.com/th...-updates-and-eol-php-7-4-8-1-backports.33134/

I believe I should be fine however I want to confirm.

I tested and got the output:

Code (Text):

bash php-eol-cve-2026-109618-check.sh
CVE-2026-109618 / CVE-2026-109619 check
PHP binary    : /usr/local/bin/php
PHP version   : 8.3.36
PHP_VERSION_ID: 80336

version check                      PATCHED      8.3.36 >= 8.3.36

Overall: PATCHED

I am re-running just in case.

 

Thanks for keeping centminmod up to date!

I expect this will happen a lot more frequently now (it was found with GPT Sol!). How did you guys find out about this? Are there any specific PHP/Nginx/MariaDB mailing lists that we should subscribe to that would always have up-to-the-minute alerts?

Were it not for the email from XenForo this morning, I would not have found out about it until much later.

 

I found out about it from xenforo.com

https://xenforo.com/community/threads/psa-critical-php-vulnerabilities.240879/

And looked it up

Reddit has also been a good source of information for me. That's how I found out about copy fail, dirtyfrag etc. Comments from others are usually helpful.

 

It was posted on PHP.net and then picked up on news channels. I actually heard it through a downline mailing list for a project I used to help out with.

This can get noisy for every release but you can subscribe here php.announce mailing list I also subscribe to https://www.cyber.gov.au/alerts-and-advisories which is helpful as well

 

A really wild ride, and they are going to need a better way to announce and patch these as that was just too hard. Apparently the leak came from the company who found it.

@eva2000 is there any way to add some kind of automated unattended critical PHP/Nginx update or a way that we can somehow flag it?

I ask because the timing of 1am is a rough one for me to try and sit through and taking the site offline whilst the most secure route isn't ideal. If we know new version numbers are coming, some way to have the system run a cron to check if they are available and if so push them