Bug 2556842

Summary:	CVE-2026-109618 & CVE-2026-109619: Undisclosed unauthenticated RCE exploit in PHP
Product:	[Fedora] Fedora	Reporter:	Daniel Milnes <daniel>
Component:	php	Assignee:	Remi Collet <fedora>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	a.dekker, camelot, cylopez, edgar.hoch, eric.eisenhart, esm, fedora, jorton, lehman, olegon, rhbz, villapla
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
URL:	https://cert.europa.eu/publications/security-advisories/2026-018/
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2406954

Description Daniel Milnes 2026-10-20 22:47:39 UTC

We don’t have many details yet, but the PHP team have warned they will be disclosing an unauthenticated RCE in PHP Core.

The vulnerability will be disclosed officially at Wednesday, 21 October 2026 at 14:00 UTC, however there is anecdotal evidence on social media of exploits already existing.

Raising this ticket to track our response and consider as a release blocker.

https://cert.europa.eu/publications/security-advisories/2026-018/
https://www.php.net/archive/2026.php#2026-10-20-1

Reproducible: Always

Comment 1 Fedora Blocker Bugs Application 2026-10-20 22:49:56 UTC

Proposed as a Blocker for 45-final by Fedora user thebeanogamer using the blocker tracking app because:

 Critical security vulnerabilities should be fixed.

PHP is not a critical path package, but it is a very common package to install on servers.

Comment 2 Daniel Milnes 2026-10-21 13:56:11 UTC

https://www.php.net/index.php#2026-10-21-5 the vulnerability downloads are now available.

Fixed releases are 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

I can see some cancelled Koji builds, presumably testing to be ready for now https://koji.fedoraproject.org/koji/packageinfo?packageID=72

Comment 3 camelot 2026-10-21 15:46:37 UTC

When can an update be expected?
My Ubuntu server are already updated, the Fedora servers have disabled & masked webservers

Comment 4 Edgar Hoch 2026-10-21 15:55:13 UTC

Packages are available, see https://bodhi.fedoraproject.org/updates/?packages=php

If the new packages are currently not available on your mirror, you may download the packages from koji (see link above). Then install the package files using dnf.
Example (read BUILD_NUMBER from koji webpage): "koji download-build BUILD_NUMBER --arch=x86_64"

Comment 5 Arjan Dekker 2026-10-21 17:04:46 UTC

When will the rest of the PHP updates be available?
For example RHEL8 PHP 8.2, RHEL9 8.0 and RHEL7 ELS release?

Comment 6 Adam Williamson (Fedora) 2026-10-21 23:11:50 UTC

This is a Fedora bug, not the best place to ask. Folks here are mainly concerned with Fedora.

https://access.redhat.com/security/cve/cve-2026-109618 shows RHEL 8's php:7.4 stream as 'fixed' and RHEL 7 as 'Vulnerable Code not Present'.