Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Published: 21 October 2026

Background

On 21 October 2026, the PHP project published security releases fixing two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2 and can allow unauthenticated remote code execution on any server that serves web requests with PHP, regardless of the application running on top of it. All common PHP deployment modes are affected, including PHP-FPM, Apache mod_php and php-cgi. CERT-EU has issued Security Advisory 2026-018 on the matter.

The vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project; some Linux distributions provide backported fixes for those versions.

FossID Workbench is a PHP web application. The vulnerabilities are in the PHP runtime itself, not in Workbench code, and FossID is not aware of any attack targeting Workbench specifically. However, because the flaws can be triggered before any application code runs, a Workbench instance served by a vulnerable PHP version is exposed to any party that can reach it over the network. Please treat this notice as urgent even if your Workbench is only reachable from internal networks.

What you need to do

Which action applies to you depends on how you obtained PHP.

1. You run Workbench from FossID container images (quay.io) or the Helm chart

The FossID Workbench container images bundle their own PHP runtime. Images published before 2026-10-20 include a vulnerable PHP version.

FossID has published updated images with the fixed PHP version. We strongly encourage you to pull the latest image from quay.io/fossid/workbench and redeploy as soon as possible. The fixed images are tagged 26.2.1 or latest and later. No configuration or database changes are needed for this update.

To verify, run php -v inside the running container and confirm if the version is 8.4.27 or later (or the corresponding fixed release of the PHP branch shown).

2. You installed Workbench on your own servers from FossID’s deb/rpm packages or with Ansible

In this case, PHP is not distributed by FossID. It is provided by your Linux distribution (Debian, Ubuntu, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux or similar), and you will most likely receive, or have already received, a security notice from your OS vendor.

FossID strongly encourages you to follow all such security notices from your OS vendor and, in this case, to upgrade PHP to a fixed version without delay. Note that distributions often backport the fix into their existing package version, so the package version number may not match the PHP release numbers above. Consult your vendor’s advisory for the exact package version that contains the fix. After updating, restart PHP-FPM and the web server, so the new runtime is in use.

If your distribution ships PHP 8.1 or older and provides no backported fix, upgrade to a supported PHP version. Workbench requires PHP 8.3 or later (8.4 or later from Workbench 26.2.1).

If you cannot update immediately

Restrict network access to the Workbench to trusted networks until the update is applied. The PHP project’s advisory also describes interim php.ini mitigations. These reduce exposure but do not make an installation safe, and the suggested post_max_size limit would restrict source code uploads to the Workbench, so updating PHP remains the only complete fix.
If you have questions about this notice or need help updating, contact FossID support at https://support.fossid.com/.