PHP Critical Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and rConfig

• The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. They fix two critical vulnerabilities, CVE-2026-109618 (RCE via OOM corruption, GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (RCE via stale global state, GHSA-6wmf-4rv5-p3rp), both of which can allow unauthenticated remote code execution. Security vendors and researchers refer to the pair as PHP2Shell.
• The PHP project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk for mod_php. It states that updating is the only complete solution.
• These are vulnerabilities in PHP, not in rConfig’s own code. rConfig runs on PHP, so the fix is to update PHP on the server that hosts it. We are testing each rConfig version against the fixed PHP releases and will update this advisory as findings are confirmed.
• Update PHP on the host running rConfig as soon as the fixed version is available from your package source, and keep rConfig off the public internet until then.

What is known, and how sure we are

Every statement is labelled: Confirmed means stated by the PHP Foundation or CERT-EU; Reported means relayed second-hand and not verified; Unknown means nothing reliable is public.

Vulnerable products

These are vulnerabilities in PHP, not in rConfig’s own code. Any rConfig installation running on an affected PHP version is exposed through PHP. Until the PHP version on your server is updated, treat the installation as potentially exposed.

rConfig runs on the PHP version installed on your own server, so exposure depends on that version. The tables below map each rConfig release to the PHP versions it runs on, taken from its composer.json and composer.lock, and to the fixed PHP release identified for those versions. If you run rConfig Pro 7 or rConfig Core from February 2024 onwards, check the version in your composer.json and map it to the tables. No rConfig release is confirmed vulnerable or not vulnerable yet; the tables are updated as we test each one.

rConfig Pro

rConfig Core

Products confirmed not vulnerable

No rConfig release is confirmed not vulnerable at this time.

• Updating PHP is the only complete solution. The measures below reduce exposure to specific attack paths but do not make an installation safe.
• If you have not already, restrict access to rConfig immediately, ideally to a VPN or trusted management IP addresses. Do not expose the web interface directly to the internet.
• CVE-2026-109618 (OOM corruption): set memory_limit=-1 in a way applications cannot override (for example php_admin_value in the FPM pool or Apache configuration) and check that nothing puts a finite limit back. Set a low post_max_size (8M if you do not need file uploads, 32M if you do) and keep upload_max_filesize below it. Use a container or cgroup limit as an availability boundary. Do not use RLIMIT_AS or RLIMIT_DATA.
• CVE-2026-109619 (stale global state): set session.upload_progress.enabled=0 and restart every PHP worker, using php.ini, an FPM pool or server configuration that applies before request parsing. On PHP 8.5, also set fatal_error_backtraces=0.
• As a precaution rConfig took enterprise-demo, msp-demo, isp-demo, edu-demo, sme-demo (rconfig.com), crm.rconfig.com and the portal out of service. After patching PHP, all seven were back in service by 22 October 2026, 08:57 IST. We will keep monitoring these systems.

The PHP project released the fixed versions below on 21 October 2026. The remedy is to update PHP on the host running rConfig. Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages. Third-party repositories can take longer.

How to update PHP: download the fixed release or find your operating system’s package from the PHP project’s downloads page. PHP downloads. For rConfig specifically, see Updating PHP for rConfig and, for the Docker image, Docker setup.

Availability of fixed PHP packages, at the time of this update. We will update this table as each source is confirmed:

After patching

If your rConfig server was reachable from the public internet, rotate all secrets and passwords on the server after you have patched.

The PHP project’s advisories describe both issues technically and confirm remote code execution against mod_php and PHP-FPM. CERT-EU does not report any exploitation of these vulnerabilities in its advisory.

CERT-EU’s statement that the issues could affect all PHP versions from PHP 5 onwards comes from posts on social media and has not been confirmed. The PHP project provided source backports for PHP 7.4, 8.0 and 8.1 only.

This advisory was prepared by rConfig from the public sources below. It will be revised as the PHP Foundation publishes details and as our assessment progresses.

1. CERT-EU Security Advisory 2026-018, Critical Vulnerabilities in PHP
2. PHP Foundation announcement, 20 October 2026
3. PHP Foundation (X), release announcement
4. Remi repository (Bluesky), package availability
5. Ubuntu PHP PPA maintainer, issue tracking the fix
6. PHP project security advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), RCE via stale global state
7. PHP project related security advisory GHSA-w8hw-w9fx-j79w
8. PHP.net security advisory and release announcements, 21 October 2026

To report a vulnerability or ask about your deployment, email security@rconfig.com. See our security advisories and responsible disclosure policy.

This advisory is based on information available at the time shown above, which may be incomplete or change. It is provided for information and does not create any warranty or commitment. Each change is recorded in the revision history.