PHP Audit CVE-2026-109618 / CVE-2026-109619

Use this skill before patching, or to verify a patch, on servers that serve PHP. It does not modify configuration, packages or services. Use existing metadata; if indexes need to be refreshed or a temporary diagnostic needs to be created, state that need outside the read-only audit.

Reference data (advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp):

• Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 8.1 and earlier depend on vendor backports.
• Partial official mitigation: session.upload_progress.enabled = 0.
• Risk: mod_php is the highest-risk case.

Do not run proof-of-concept tests or third-party binaries. Use the official advisories and each package's changelog as the source.

1. Machine type and SAPI

• VPS or VM: the PHP source with apt-cache policy phpX.Y-fpm (Ubuntu, Debian or Surý).

• Server with panel: each domain's PHP and its status.

  • cPanel: /opt/cpanel/ea-phpXY/, per-domain version in MultiPHP (whmapi1 php_get_vhost_versions).
  • DirectAdmin: /usr/local/phpXY/.
  • CloudLinux: /opt/alt/phpXY/.
  • Plesk: /opt/plesk/php/X.Y/, with each domain's handler and its status:

  plesk db -N -e "SELECT d.name,h.php_handler_id,d.status FROM domains d JOIN hosting h ON h.dom_id=d.id"
  

  Check with DNS and the logs which domains serve real traffic. Old copies that only receive scans are candidates for suspension.

• Hypervisor or cloud (Proxmox, VMware ESXi, Hyper-V, KVM, AWS, Azure, GCP): the host does not protect the guests' PHP. List the VMs (e.g. qm list, virsh list, or the provider console) and audit each one as a VPS.

• Docker or Kubernetes: the image and version of each container (docker exec <c> php -v, kubectl get pods -o jsonpath='{..image}').

• SAPI of each website:

  • mod_php: apache2ctl -M | grep php;
  • FPM: SetHandler proxy:unix:... or fastcgi_pass.

2. Actual version and patch

• Ubuntu: the base version does not change. On 22.04, the fixed revision is 8.1.2-1ubuntu2.28.

  zgrep -E 'CVE-2026-10961[89]' /usr/share/doc/php8.1-common/changelog.Debian.gz
  

• Surý: supported branches, at the fixed version. On unsupported branches, require a vendor advisory that expressly identifies the backport; do not infer protection from the version number alone.

  • Distinguish the Debian repository packages.sury.org/php from the Ubuntu PPA. Confirm the fixed revision for the specific distribution; do not swap their sources.

• RHEL, Alma or Rocky: dnf updateinfo list --security | grep php and rpm -q --changelog php-fpm. Remi announced packages with a delay.

• Panels: compare the installed version with the candidate for its channel (yum/apt of ea-php, alt-php or CustomBuild). In Plesk:

  apt-cache policy plesk-php80 plesk-php82 plesk-php83 plesk-php84
  

  If the Plesk changelog does not cite the CVEs, rely on the version (8.2.35, 8.3.36) and on the official vendor advisory. A recent build date, by itself, does not prove that it includes the patch.

• Official PHP or Docker: php -v against the fixed versions.

3. Repositories

Review the logs of the last index update and its date; apt-get update writes metadata and is not part of this read-only mode:

• Signature errors, missing keys or sources that no longer publish indexes.
• Candidates older than the vendor security advisory.
• Sources that do not correspond to the distribution or duplicate repositories.

Document the blockage without importing keys or modifying sources. A new key must be verified with the vendor's current documentation, not with an identifier copied from an error.

4. Effective mitigation

• FPM: php-fpmX.Y -tt | grep upload_progress for the pool and php-fpmX.Y -i | grep upload_progress for the ini.
• Plesk: /opt/plesk/php/X.Y/sbin/php-fpm -i | grep upload_progress in each version.
• Real website: use an authenticated diagnostic that is already available. If none exists, mark the data point as unverified; a temporary check requires write permission, restricted access and guaranteed removal. Do not publish phpinfo().
• Overrides: .user.ini, .htaccess and each Plesk domain's php.ini (/var/www/vhosts/system/<dominio>/etc/php.ini).
• Function usage: grep -rE "upload_progress|PHP_SESSION_UPLOAD_PROGRESS" --include=*.php. Discard matches in CSS classes.## 5. Processes with the previous version

for p in $(pgrep -f 'apache2|php-fpm'); do grep -l '(deleted)' /proc/$p/maps 2>/dev/null; done

A removed mapping is a signal to investigate, not conclusive proof of the patch. Compare the installed package with the executable or module loaded by each worker; the absence of (deleted) does not prove protection either.

6. Unsupported branches

If any web uses an unsupported branch, including 8.1 as of October 2026, propose upgrading the version with php-version-upgrade: many providers do not backport patches to those branches.

7. Report

Web	Machine	SAPI	PHP source	Package	Patch available	Patch applied	Mitigation	Next step

Add to the report:

• the unsupported branches;
• the repositories that block updates;
• what could not be verified.

Sources

• Official PHP advisory and fixed versions.
• CVE-2026-109618: project advisory.
• CVE-2026-109619: project advisory.
• Fixed Ubuntu packages: USN-8948-1.

Verify the current advisories before acting: distribution revisions and per-provider availability change.