Critical vulnerabilities have been discovered in all PHP versions from version 7.0. These vulnerabilities was to be announced publicly tomorrow. However, due to leaks, the announcement was moved up to today on an emergency basis.
For more details: https://www.php2shell.com/
= If you have a support contract with Koumbit =
If we manage your server, have Shared Hosting of a Managed Nextcloud or Drupal website, we took urgent action this morning. The PHP versions that have already received security patches are up to date on your server. If the affected PHP version has not yet been patched (or is too old), we have applied changes to the "php.ini" file to mitigate these vulnerabilities and prevent them from being exploited.
Please note that if we only manage updates to your NextCloud installation, this is not included.
= If we do not manage your server =
Be sure to apply the available updates for PHP as soon as possible!
If your server installs PHP from Debian source packages, note that only versions 8.2 and 8.4 have currently received security fixes.
You can check the status of updates for both vulnerabilities here:
- https://security-tracker.debian.org/tracker/CVE-2026-109618
- https://security-tracker.debian.org/tracker/CVE-2026-109619
If you install PHP from the Sury source code, all versions have been patched.
If your server is using a version of PHP that has not yet been patched - or won't be - you can modify the PHP options in your php.ini file as follows to mitigate the risk.
memory_limit = -1 post_max_size = 8M upload_max_filesize = 8M session.upload_progress.enabled = 0 display_errors = 0 fatal_error_backtraces = 0 expose_php = 0
Please note that this should ideally be only a temporary solution. If your server is running an unpatched version, you should schedule a PHP update as soon as possible. In the meantime, you could also choose to use the version provided by the Sury repositories: https://packages.sury.org/php/
If you have any questions or need assistance with this, please contact us at support@koumbit.org.
The Koumbit Network
