[ixpmanager] Critical PHP security release due today 14:00 UTC – please prepare to patch

[Barry O'Donovan (INEX)]

Hi all,

Just an update: the PHP team have now announced the issue with details 
at:

https://www.php.net/archive/2026.php#2026-10-21-5

The advice remains the same: update now, as only an update is a complete 
solution.

Kind regards,
Barry O'Donovan
INEX




------ Original Message ------
>From "Barry O'Donovan (INEX) via ixpmanager" <ixpmanager at inex.ie>
To "INEX IXP Manager Mailing List" <ixpmanager at inex.ie>; 
"ixpmanager-announce at inex.ie" <ixpmanager-announce at inex.ie>
Cc "Barry O'Donovan (INEX)" <barry.odonovan at inex.ie>
Date 21/10/2026 12:50:53
Subject [ixpmanager] Critical PHP security release due today 14:00 UTC – 
please prepare to patch

>
>
>Hi all,
>
>A heads-up that the PHP security team has pre-announced a critical 
>security release, scheduled for today, Wednesday 21 October 2026 at 
>14:00 UTC (15:00 Irish time):
>
>   https://www.php.net/archive/2026.php#2026-10-20-1
>
>It fixes two vulnerabilities, both rated critical (CVSS v4.0 9.2). 
>Affected and fixed versions will only be confirmed with the release, 
>but third-party reports (reported as CVE-2026-109618 and 
>CVE-2026-109619, but these are not confirmed in the official PHP 
>announcement) describe pre-authentication remote code execution in 
>PHP's multipart/form-data request handling, potentially affecting all 
>PHP versions from 5 onward. Details leaked before a fix was available, 
>and mass exploitation is expected very soon after release.
>
>This is not an IXP Manager bug – but as IXP Manager v7 runs on PHP 8.4, 
>every installation is likely affected, and the vulnerable code runs 
>before IXP Manager (or Laravel) ever sees the request. Many of you run 
>your IXP Manager portal on the public internet for members, so please 
>treat this as urgent.
>
>What we recommend:
>
>1. Patch as soon as fixed packages are available. Distro and PPA builds 
>may lag upstream by some hours. Restart Apache/PHP-FPM afterwards, and 
>also restart any long-running PHP processes.
>
>2. In the meantime, consider the interim measures being circulated 
>(unofficial – PHP's position is that the only real fix is upgrading):
>
>    - Disable session upload progress in your php.ini (not that some 
>reports say this is insufficient):
>
>        session.upload_progress.enabled = Off
>
>    - Block multipart requests at the web server, for all HTTP methods. 
>Example in the below link for Apache 2.4:
>
>        <If "req('Content-Type') =~ /multipart/i”>
>            Require all denied
>        </If>
>
>      This will break file uploads in IXP Manager (e.g. member logos) 
>until removed – but this should be acceptable.
>
>    - If your portal doesn't need to be public, restrict it to trusted 
>networks until patched.
>
>3. Don't forget other PHP on the same box or elsewhere in your IXP – 
>route server tooling, other web apps, staging/dev instances, etc.
>
>4. Once patched, review web server logs for unusual multipart requests 
>since ~15:00 UTC on 20 October.
>
>A good practical write-up of interim steps is here:
>
>   
>https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
>
>
>Thanks,
>Barry
>
>--
>Kind regards,
>Barry O'Donovan
>INEX
>
>_______________________________________________
>INEX IXP Manager mailing list
>ixpmanager at inex.ie
>Unsubscribe or change options here: https://www.inex.ie/mailman/listinfo/ixpmanager
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.inex.ie/pipermail/ixpmanager/attachments/20261021/0641c1d8/attachment.htm>