CVE-2026-109618 and CVE-2026-109619

If it's minor version bumps, I'm all for forcing it but have an option to disable it.

A better way to handle it would be to have a note in the terminal when the person next updates centminmod and have them enable forced updates by adding the variable to custom config?

 

Completely understand your hesitation, but I think if its an opt in via a flag or an option in the menu to turn on Critical Updates or a way for us to both opt in and trigger it from our side.

I was going to just set cmupdate on a cron and then try to compile it but in the end I took the lazy route

 

Have to say thanks to XenForo too. Even though not an active user. Was away on holiday, the old laptop I lug around just in case got to be used again. Painless with Centmin.

I'd be quite tempted to have an awol opt in auto update option. I mean we leave unattended upgrades to do it's thing and that works well enough.

A SMS ( old school I know ) service ( happily pay for ) would also be fab. SMS is now a clear separation for me from social/chat notifications. I know SMS can be delayed too. There is nothing perfect, I could of just sat down on the cinema and turned my phone off

Great work as always @eva2000 Thanks!

 

I also understand the hesitation, but would immediately opt-in to critical automatic security updates if the option was available in Centminmod.

 

PHP

23 Oct 2026

Informational advisory: Session upload progress

We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.

The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.

 

I put it in the custom php.ini already...

 

Why the 2 beta versions?