Critical PHP security update (October 2026)#

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2) that allow unauthenticated attackers to execute code remotely.

What is affected?#

Every PHP installation that serves web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers the risk highest for mod_php, where an attack has been demonstrated that works before any application code runs.

Supported i-doit installations run on PHP 8.2–8.4. All of these branches receive a fix.

What you need to do#

On-premises (Linux)#

The Linux distributions received the patches in advance and ship their own packages. Use your distribution's packages:

1. Back up first: snapshot of the VM, or a backup of the i-doit directory, the database and the PHP configuration.

2. Install the PHP update via the package manager and restart the services. PHP-FPM and Apache only load the new packages after a restart.

   Distribution	Update	Restart services
   Debian 13 (packages since 2026-10-21, 13:45 UTC, detailed guide)	sudo apt update && sudo apt upgrade	sudo systemctl restart apache2 php8.4-fpm
   Ubuntu 24.04 (packages since 2026-10-21, approx. 14:05 UTC, detailed guide)	sudo apt update && sudo apt upgrade	sudo systemctl restart apache2 php8.3-fpm
   RHEL 10 / Rocky / Alma	sudo dnf update 'php*'	sudo systemctl restart httpd php-fpm
   SLES 15 SP6	sudo zypper refresh && sudo zypper patch	sudo systemctl restart apache2 php-fpm

   With mod_php instead of PHP-FPM, restarting the web server is enough.

3. Check that the fix is installed (see below).

4. Test i-doit: log in, open and save an object, open the Admin Center.

For details on switching to a different PHP version, see PHP update and System requirements.

On-premises (Windows)#

The PHP project also provides the new versions as Windows binaries. Replace PHP as described in Update PHP and MariaDB on Windows.

PHP 8.1 or older#

The PHP project no longer provides updates for these versions. Some distributions and LTS vendors provide backported fixes, for example Ubuntu 22.04 LTS for PHP 8.1 (package 8.1.2-1ubuntu2.28, USN-8948-1). Ask your vendor, or upgrade your installation to a supported version (8.2–8.4). PHP 8.2 receives security updates until December 31, 2026.

If you cannot update immediately#

According to the PHP project, there is no complete mitigation; only the update closes the vulnerabilities. Until then, these steps reduce the risk:

• Set session.upload_progress.enabled = 0 in php.ini or in the FPM pool and restart all PHP workers. This blocks the confirmed attack paths for CVE-2026-109619. ini_set() or .user.ini are not sufficient.
• Make the i-doit server reachable only from the internal network or via VPN.

The other measures from the PHP announcement, such as memory_limit=-1 or a very small post_max_size, are not practical for i-doit.

i-doit appliance and Docker images#

We provide updated versions of both with the patched PHP version. If you use the appliance, you can install the update via the package manager as described above. For Docker, pull the updated image as soon as it is published.

i-doit Cloud#

If you use our cloud, you do not need to do anything — we update your environment ourselves.

Sources#

• Security advisory: Critical remote code execution vulnerabilities (php.net, 2026-10-21)
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP