[pmwiki-announce] Security alert: Critical PHP RCE vulnerabilities - update immediately

[Petko Yotov]

Hello everyone,

Today the PHP development team has announced two critical remote code 
execution (RCE) vulnerabilities affecting PHP. An attacker may be able 
to execute arbitrary code on a vulnerable server without authentication.

These vulnerabilities affect PHP itself, not just any particular web 
application, and not just PmWiki. PmWiki administrators and webmasters 
should check every server running PHP, including systems hosting 
multiple websites.

Vulnerabilities:
* CVE-2026-109618: https://www.cve.org/CVERecord?id=CVE-2026-109618
* CVE-2026-109619: https://www.cve.org/CVERecord?id=CVE-2026-109619

The vulnerabilities affect all PHP versions from PHP 5 onwards, 
including:
* All PHP 5.x and 6.x versions
* All PHP 7.x versions, including PHP 7.0
* PHP 8.0 and 8.1, all versions
* PHP 8.2 before 8.2.35
* PHP 8.3 before 8.3.36
* PHP 8.4 before 8.4.27
* PHP 8.5 before 8.5.12

Official security announcement:
   https://www.php.net/archive/2026.php

The PHP project has released fixes for PHP 8.2.35, 8.3.36, 8.4.27 and 
8.5.12. Some vendors also provide backported fixes for older branches, 
including PHP 7.4, 8.0 and 8.1.

What you should do:

Check which PHP version your web server actually uses. Remember that the 
command-line PHP version may differ from the version used by Apache or 
PHP-FPM.

Update immediately to a fixed release, or install the security-patched 
package supplied by your Linux distribution or hosting provider.

If you are running an obsolete PHP branch such as PHP 7.0, do not assume 
it is safe. Upgrade to a currently supported PHP version, or confirm 
with your vendor that a security fix has been applied.

If you cannot patch an affected server immediately, consider isolating 
it from public access until it can be secured.

Further information in English:

PHP security announcement:
   https://www.php.net/archive/2026.php#2026-10-21-2

PHP advisory for CVE-2026-109618:
   https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

PHP advisory for CVE-2026-109619:
   https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

CERT-EU security advisory:
   https://cert.europa.eu/publications/security-advisories/2026-018/

Please do not assume that a PmWiki installation is safe simply because 
it is up to date. These vulnerabilities are in the underlying PHP 
runtime, so updating PmWiki alone will not fix them.

Please check your servers and apply the appropriate security updates as 
soon as possible.

Petko

-- 
If you upgrade :  https://www.pmwiki.org/Upgrades