Subject: Critical PHP vulnerabilities - unauthenticated RCE (CVE-2026-109618, CVE-2026-109619)

Dear all,

The PHP team has released fixes for two critical vulnerabilities that allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, where a demonstrated exploit shows that an unauthenticated request can trigger the attack before any application code runs.

Details: https://www.php.net/archive/2026.php#2026-10-21-5

Is my server affected?

Yes -- if you run Roundcube, adminer, Z-Push or any other PHP application on an iRedMail server, your server is affected.

What should I do?

- If your OS vendor already provides updated PHP packages containing this fix, upgrade immediately.

- If you are running an older OS release without updated packages, or your vendor does not yet offer updated PHP packages, consider temporarily stopping the php-fpm service until updated packages become available. Please note that Roundcube webmail and other PHP-based web services will be unavailable while php-fpm is stopped.

Which Linux distributions offer new PHP packages with the fix?

The following vendors have released patched PHP packages:

- Ubuntu: 14.04 LTS and later releases.
- https://ubuntu.com/security/notices/USN-8948-1
- https://ubuntu.com/security/notices/USN-8948-2

- Red Hat:
- https://access.redhat.com/errata/RHSA-2026:87072
- https://access.redhat.com/errata/RHSA-2026:87080

- AlmaLinux: patched packages released.
- https://almalinux.org/blog/2026-10-21-p … 26-109619/

- Rocky Linux:
- https://forums.rockylinux.org/t/critica … s/20856/12

See also

- https://www.php2shell.com