Two critical PHP vulnerabilities have a fix scheduled for today.
CVE-2026-109618 and CVE-2026-109619 are both rated CVSS 9.2 and allow remote code execution without authentication on default PHP installs. Details leaked before the fix, so exploits are already in the wild. PHP has scheduled the patches for 14:00 UTC.
Here's where things stand for RunCloud users:
- We've disabled session.upload_progress on all servers as a temporary mitigation. It closes the known attack route until official fixes land. Uploads still work; the only side effect is that PHP-based upload progress bars may stop updating.
- Once PHP publishes the fixes, patches will be applied automatically to PHP 8.2 and newer. Timing depends on your stack (native, Docker, OpenLiteSpeed/LiteSpeed Enterprise), and we'll post updates as each one ships.
⚠️ If you run PHP 8.1 or older, switch your web apps to 8.2+ now. Those versions are end-of-life and won't receive an official fix. The mitigation stays active on them, but it's no substitute for upgrading.
Optional: We've released two NGINX templates that block or rate-limit multipart requests before they reach PHP. Pick the one that fits your site.
Full details, WordPress-specific guidance, and live patch status for every stack:
community.runcloud.io/t/critical-php…
community.runcloud.io Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619): What RunCloud Is Doing PHP is scheduled to release fixes for two critical vulnerabilities today at 14:00 UTC. Both are rated CVSS 9.2. Both are reported to allow remote code execution without authentication on default PHP... CVE-2026-109618 and CVE-2026-109619 are both rated CVSS 9.2 and allow remote code execution without authentication on default PHP installs. Details leaked before the fix, so exploits are already in the wild. PHP has scheduled the patches for 14:00 UTC.
Here's where things stand for RunCloud users:
- We've disabled session.upload_progress on all servers as a temporary mitigation. It closes the known attack route until official fixes land. Uploads still work; the only side effect is that PHP-based upload progress bars may stop updating.
- Once PHP publishes the fixes, patches will be applied automatically to PHP 8.2 and newer. Timing depends on your stack (native, Docker, OpenLiteSpeed/LiteSpeed Enterprise), and we'll post updates as each one ships.
⚠️ If you run PHP 8.1 or older, switch your web apps to 8.2+ now. Those versions are end-of-life and won't receive an official fix. The mitigation stays active on them, but it's no substitute for upgrading.
Optional: We've released two NGINX templates that block or rate-limit multipart requests before they reach PHP. Pick the one that fits your site.
Full details, WordPress-specific guidance, and live patch status for every stack:
community.runcloud.io/t/critical-php…
