Oct 21, 2026 · @iwaa_security
Two critical PHP vulnerabilities (score 9.2/10) allow an attacker to take control of a web server without authentication. Fixes have been available since 21 October 2026: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 without delay. Every internet-facing PHP application is affected, including Nextcloud, WordPress, Moodle and Mautic. This article summarises the CERT-EU alert and details the actions to take for Nextcloud instances.
What you need to know
CERT-EU, the incident response team for the European institutions, published advisory 2026-018 on 20 October 2026 and updated it on 21 October after the fixes were released.
| Item | Detail |
| References | CVE-2026-109618 and CVE-2026-109619 |
| Severity | CVSS v4.0: 9.2/10 for each |
| Impact | Unauthenticated remote code execution |
| Fixes | Released by the PHP team on 21 October 2026 |
| Exploitation | Proofs of concept are circulating publicly |
A single unauthenticated request can trigger the attack, before any application code even runs. The first flaw exploits memory corruption when PHP’s memory limit is exceeded. The second exploits stale internal state left between two requests handled by the same worker.
With proofs of concept in circulation, CERT-EU considers exploitation already likely.
Who is affected
Every PHP installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php the most exposed setup.
| PHP branch | Vulnerable versions | Fixed version |
| 8.5 | Before 8.5.12 | 8.5.12 |
| 8.4 | Before 8.4.27 | 8.4.27 |
| 8.3 | Before 8.3.36 | 8.3.36 |
| 8.2 | Before 8.2.35 | 8.2.35 |
| 8.1 and older | All | No official release (end of life) |
Many products embed PHP without exposing it directly. NCSC-NL maintains a list of these third-party products to help you identify them.
What to do now
The only complete protection is updating PHP. The action depends on how Nextcloud is installed.
Server installation (system packages)
- Update PHP from your distribution’s repositories: Linux vendors received the fixes in advance.
- Restart PHP-FPM and Apache or Nginx.
- Check the version actually in use: php -v on the command line, then the PHP-FPM version in Nextcloud under Administration settings > Overview.
If you use the Remi repository on RHEL, Rocky Linux or AlmaLinux, note that it did not publish updates on release day. The PHP team recommends switching to distribution packages or building PHP from source.
If you are still on PHP 8.1 or older, plan an urgent upgrade or contact your extended support vendor.
Nextcloud All-in-One (AIO)
Update to AIO v14.4.1, which includes the fixed PHP versions. Start the update from the AIO admin interface.
Official “nextcloud” Docker image
At the time of publication, the official images do not yet include the fixed PHP versions, as they depend on the upstream PHP base images. Check the bundled version with docker exec <container> php -v and follow the Nextcloud team’s issue. In the meantime, apply the temporary mitigations below and isolate the instance.
If you cannot update immediately
CERT-EU recommends isolating internet-facing applications until the fix is applied and verified. In practice: VPN-only access, IP filtering, or taking the service offline temporarily.
Temporary mitigations
These measures reduce exposure to specific attack paths, but they do not make an installation safe. They are only a stopgap until you update.
Apply them in php.ini, in the PHP-FPM pool or in the Apache configuration, using php_admin_value or php_admin_flag. They have no effect when set via .user.ini or ini_set().
- session.upload_progress.enabled = 0
- memory_limit = -1, locked so the application cannot override it, combined with a memory limit at container or cgroup level
- On PHP 8.5 only: fatal_error_backtraces = 0
Example for a PHP-FPM pool:
php_admin_value[memory_limit] = -1
php_admin_flag[session.upload_progress.enabled] = off
Then restart every PHP worker. Also check that no other setting reinstates a finite memory limit.
Caution, specific to Nextcloud. CERT-EU also suggests lowering post_max_size to 32 MB. On Nextcloud, this can block large file uploads, from both the web interface and the sync clients. Test its impact before applying it in production.
Follow-up and support
This article will be updated as the situation evolves, in particular when fixed Nextcloud Docker images are released.
IWAA CLOUD’s teams can help you inventory your exposed PHP servers, apply the fixes and review your logs. Contact: support@iwaa.dz