Customer Information: Critical Vulnerabilities in PHP
and Our Measures

1. The vulnerabilities

The PHP project announced the publication on 20 October 2026. Because of a leak, it was brought forward by
one day: the details and the fixed versions became public on 21 October 2026 between approx. 15:40 and
16:00 CEST (first media reports from 15:42, official PHP announcement at 16:00). According to PHP, all PHP
installations that handle web requests are affected, including PHP-FPM, which EGroupware also uses. An
attack is possible without logging in and takes place before any application code runs. It therefore does not
matter which PHP functions EGroupware itself uses.

Vulnerability Description according to the PHP advisory
CVE-2026-109618
“RCE via OOM
corruption”
If PHP runs out of memory during a request, processing can abort while internal request data
is only partially initialised. The subsequent cleanup then treats this invalid data as valid.
CVE-2026-109619
“RCE via stale
global state”
Internal data of a request can persist even though its memory has already been freed. A later
request handled by the same PHP process can then use this stale data.
The vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to PHP, there is no complete
mitigation without updating.

2. Why PHP-FPM is affected and what we changed

EGroupware runs on PHP-FPM. A pool of continuously running PHP processes (“workers”) handles many
requests one after another. This is fast, but it also means that whatever one request leaves behind in a worker
can affect the next request in the same worker. This is exactly what the vulnerabilities exploit.

CVE-2026-109619: An attacker sends a crafted request that leaves stale data in the worker. If the next
request is handled by the same worker, this can lead to code execution. Confirmed attack paths use the
PHP “upload progress” feature ( session.upload_progress ) and, on PHP 8.5, additionally error backtraces
for fatal errors ( fatal_error_backtraces ).

CVE-2026-109618: An attacker deliberately pushes PHP to the memory limit of a request ( memory_limit )
so that processing aborts at a critical point.
Until the fixed PHP version was available, we therefore applied the mitigations recommended by the PHP
project in the PHP-FPM configuration.

Upload sizes ( post_max_size , upload_max_filesize ) are already limited in EGroupware. We did not lower
them further, as the PHP project mentions as an additional option, because larger uploads in the file manager
would then no longer be possible.

To make the update available quickly, we switched the base image of our Docker containers to the official Alpine Linux based PHP image. PHP 8.5.12 was available there earlier than in the Ubuntu packages we had been using.

4. Results of our review

• We reviewed the EGroupware Cloud logs for the period from 20 October 2026 until shortly after all mitigations were applied on 21 October 2026 and found no anomalies. At that time, the vulnerabilities were not known to be actively exploited. Since 26 October 2026, ENISA and CISA have listed them as actively exploited. We are not aware of any attacks on EGroupware instances.
• The attack path of CVE-2026-109619 requires two requests to be handled one after another by the same PHP process. In the EGroupware Cloud, requests are distributed across several PHP-FPM servers. Together with the early first mitigation, we consider the likelihood of a successful exploitation to be very low.
• Push server: The EGroupware push server is also based on PHP (Swoole). We tested whether the attack path via upload progress can be exploited there. The result was negative. We nevertheless applied the mitigation as a precaution and updated the push server on 22 October 2026 to a version with the fixed PHP 8.4.27.
• Collabora Online: On 21 October 2026, we checked whether Collabora Online and the Collabora controller (COOL Controller) used in the cloud are affected. Neither uses PHP, so neither is affected. Collabora accesses your documents through EGroupware, which is covered by the mitigations and the PHP update.

5. Additional protection beyond the update

We kept two of the mitigations in place after the PHP update. They turn off PHP features that EGroupware does not need at all: the upload progress display and detailed error reports for fatal errors. Nothing changes for you; EGroupware works as usual. For attackers, however, there are fewer ways in: what is switched off cannot be exploited, even by future vulnerabilities.

This has already paid off: on 23 October 2026, the PHP project reported another vulnerability that has not yet been fixed (CVE-2026-115560). As protection, PHP recommends exactly this: turning off upload progress. The EGroupware Cloud and installations using our current images were therefore already protected before the vulnerability became known. PHP will deliver the final fix with its next regular update, which we will include in our images as usual.

6. What you need to do

cd /etc/egroupware-docker
docker compose pull && docker compose up -d && docker logs -f egroupware
# Press Ctrl-C once "NOTICE: fpm is running, pid 1" appears

7. Further information

• Customer information in the forum: English · German
• Release EGroupware 26.10.20261021: help.egroupware.org/t/80114
• Release EGroupware 23.1.20261021: help.egroupware.org/t/80120
• Release for Univention Nubus: help.egroupware.org/t/80124
• PHP security advisory: php.net/archive/2026.php
• The Hacker News: PHP warns of another unpatched flaw (CVE-2026-115560)
• heise online: php2shell: Critical flaws allow code injection in PHP

If you have any questions, please contact us through the usual support channels.

This customer information was created with the assistance of Claude Code and reviewed by EGroupware GmbH.