GoPlus Security Notice: Dual Unauthenticated RCE Flaws Discovered in PHP
An official security bulletin from PHP has verified that two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute remote code without authentication. To address this issue, updated versions have been released, specifically 8.2.35, 8.3.36, 8.4.27, and 8.5.12. You can view the full details at https://php.net/archive/2026.php#2026-10-21-5.
Recommended Evaluation and Mitigation Procedures
Step One: Identify your current operational environment. It is crucial to document every active component. This includes logging all entry points, services, nodes or containers, and the specific PHP SAPI in use. Additionally, record the executable paths, the exact PHP versions powering each active worker, the origins of any vendor packages or images, all configuration overrides, and the extent of public accessibility.
Step Two: Prioritize system updates. Begin your patching process with publicly accessible mod_php setups, followed by any other internet-connected PHP services and internal systems vulnerable to untrusted requests. Transition to the secured version corresponding to your current branch or utilize a vendor package that includes a confirmed backport. Before initiating the update, make sure to evaluate compatibility, create secure backups, and establish a clear rollback strategy. Once the installation is complete, reboot every worker and confirm that the updated PHP version is running correctly across all nodes.
Step Three: Minimize external visibility if immediate updating is not an option. You should firmly limit outside access to your systems. Furthermore, take the time to reassess and tighten your parameters for request limits, as well as the maximum sizes allowed for uploads and inputs.
An official security bulletin from PHP has verified that two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute remote code without authentication. To address this issue, updated versions have been released, specifically 8.2.35, 8.3.36, 8.4.27, and 8.5.12. You can view the full details at https://php.net/archive/2026.php#2026-10-21-5.
Recommended Evaluation and Mitigation Procedures
Step One: Identify your current operational environment. It is crucial to document every active component. This includes logging all entry points, services, nodes or containers, and the specific PHP SAPI in use. Additionally, record the executable paths, the exact PHP versions powering each active worker, the origins of any vendor packages or images, all configuration overrides, and the extent of public accessibility.
Step Two: Prioritize system updates. Begin your patching process with publicly accessible mod_php setups, followed by any other internet-connected PHP services and internal systems vulnerable to untrusted requests. Transition to the secured version corresponding to your current branch or utilize a vendor package that includes a confirmed backport. Before initiating the update, make sure to evaluate compatibility, create secure backups, and establish a clear rollback strategy. Once the installation is complete, reboot every worker and confirm that the updated PHP version is running correctly across all nodes.
Step Three: Minimize external visibility if immediate updating is not an option. You should firmly limit outside access to your systems. Furthermore, take the time to reassess and tighten your parameters for request limits, as well as the maximum sizes allowed for uploads and inputs.
