[ixpmanager] Critical PHP security release due today 14:00 UTC – please prepare to patch

[Barry O'Donovan (INEX)]

Hi all,

A heads-up that the PHP security team has pre-announced a critical 
security release, scheduled for today, Wednesday 21 October 2026 at 
14:00 UTC (15:00 Irish time):

   https://www.php.net/archive/2026.php#2026-10-20-1

It fixes two vulnerabilities, both rated critical (CVSS v4.0 9.2). 
Affected and fixed versions will only be confirmed with the release, but 
third-party reports (reported as CVE-2026-109618 and CVE-2026-109619, 
but these are not confirmed in the official PHP announcement) describe 
pre-authentication remote code execution in PHP's multipart/form-data 
request handling, potentially affecting all PHP versions from 5 onward. 
Details leaked before a fix was available, and mass exploitation is 
expected very soon after release.

This is not an IXP Manager bug – but as IXP Manager v7 runs on PHP 8.4, 
every installation is likely affected, and the vulnerable code runs 
before IXP Manager (or Laravel) ever sees the request. Many of you run 
your IXP Manager portal on the public internet for members, so please 
treat this as urgent.

What we recommend:

1. Patch as soon as fixed packages are available. Distro and PPA builds 
may lag upstream by some hours. Restart Apache/PHP-FPM afterwards, and 
also restart any long-running PHP processes.

2. In the meantime, consider the interim measures being circulated 
(unofficial – PHP's position is that the only real fix is upgrading):

    - Disable session upload progress in your php.ini (not that some 
reports say this is insufficient):

        session.upload_progress.enabled = Off

    - Block multipart requests at the web server, for all HTTP methods. 
Example in the below link for Apache 2.4:

        <If "req('Content-Type') =~ /multipart/i”>
            Require all denied
        </If>

      This will break file uploads in IXP Manager (e.g. member logos) 
until removed – but this should be acceptable.

    - If your portal doesn't need to be public, restrict it to trusted 
networks until patched.

3. Don't forget other PHP on the same box or elsewhere in your IXP – 
route server tooling, other web apps, staging/dev instances, etc.

4. Once patched, review web server logs for unusual multipart requests 
since ~15:00 UTC on 20 October.

A good practical write-up of interim steps is here:

   
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/


Thanks,
Barry

--
Kind regards,
Barry O'Donovan
INEX
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.inex.ie/pipermail/ixpmanager/attachments/20261021/e13d8eb9/attachment.htm>