[2026-October] Zero-day PHP exploits (CVE-2026-109618 and CVE-2026-109619)

[Isaac Eiland-Hall]

A quick update regarding some urgent maintenance on the server hosting the forum and related sites today.

Earlier today, details emerged regarding two critical remote code execution vulnerabilities in the PHP runtime, tracked under CVE-2026-109618 and CVE-2026-109619. These flaws sit deep in the PHP core multipart parser and session handling routines, meaning they can be triggered by unauthenticated web requests before any forum software or application logic even touches the connection.

Because official patches were pushed across supported branches today, the main upstream Ubuntu PPA mirrors were immediately slammed worldwide, throwing 503 service unavailable errors when trying to pull the new binary packages. Rather than taking the entire forum offline with a temporary maintenance page while waiting for the package mirrors to stabilize, I applied two vendor recommended, zero-loss configuration mitigations directly to our PHP-FPM environment.

The first change was setting session.upload_progress.enabled to 0. This disables a legacy PHP feature intended to track file upload percentages on the server side back before browsers handled progress events natively. Modern browsers and scripts handle upload tracking client-side, so forum attachments, avatar uploads, and general file handling are completely unaffected. Turning it off closes the dangling pointer condition that allows CVE-2026-109619 to corrupt worker memory.

The second change was setting memory_limit to -1. The trigger mechanism behind CVE-2026-109618 relies on forcing PHP into an unexpected out-of-memory bailout during multipart parsing to trigger an uninitialized heap state. Removing the artificial script ceiling eliminates the specific internal tripwire attackers use to force that heap corruption.

The forum and our web services remain fully operational with normal posting and attachment capabilities. I am keeping an eye on server memory utilization and will apply the official package upgrades to our PHP runtimes as soon as repository traffic levels out.

[Isaac Eiland-Hall]

And php has now been updated.

[prissi]

Debian was working after 10 minutes past the announce, so German Forum is updates as well.

[Isaac Eiland-Hall]

Later in the day, I have realized that many sites on the server are running php 8.1 which is vulnerable. I am working on updating all sites to run on 8.4, and I will then uninstall 8.1. Some sites may be down after this.

All major sites appear to be up and running. There are a number of minor sites I think that have been nonfunctional for a while. I ahve disabled (not deleted) a number of such sites. If anything stops working that we rely on, please let me know. I'll let them site idle, but if nobody complains in 2-3 months, I may start to remove some of these sites that are probably out of date.