<html><head><style type="text/css"><!--#xd1391a0b4484487 #x765480b583cd4e8ea85762525784a52c
{font-family: Avenir Next; font-size: 10.5pt;}
#xd1391a0b4484487 #x765480b583cd4e8ea85762525784a52c
{font-family: Avenir Next; font-size: 10.5pt;}
--></style><style id="css_styles" type="text/css"><!--blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] { list-style-position: inside;}
body { font-family: 'Avenir Next'; font-size: 10.5pt; }
.quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }
a.em-mention[href] { text-decoration: none; color: inherit; border-radius: 3px; padding-left: 2px; padding-right: 2px; background-color: #e2e2e2; }
._em_placeholder {color: gray; border-bottom: 1px dotted lightblue;} ._em_placeholder:before{color:gray; content: '{{ ';} ._em_placeholder:after{color:gray; content: ' }}';}
--></style></head><body style="color: rgb(0, 0, 0); overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><br /></div>
<div>Hi all,</div><div><br /></div><div>Just an update: the PHP team have now announced the issue with details at:</div><div><br /></div><div><a href="https://www.php.net/archive/2026.php#2026-10-21-5">https://www.php.net/archive/2026.php#2026-10-21-5</a></div><div><br /></div><div>The advice remains the same: update now, as only an update is a complete solution.</div><div id="signature_old" style="clear:both">
<br />
Kind regards,
<br />
Barry O'Donovan
<br />
INEX</div><div id="signature_old" style="clear:both"><br />
<br />
</div><div><br /></div>
<div x-em-replyforwardheader=""><br /></div>
<div>
<div>------ Original Message ------</div>
<div>From "Barry O'Donovan (INEX) via ixpmanager" <<a href="mailto:ixpmanager@inex.ie">ixpmanager@inex.ie</a>></div>
<div>To "INEX IXP Manager Mailing List" <<a href="mailto:ixpmanager@inex.ie">ixpmanager@inex.ie</a>>; "ixpmanager-announce@inex.ie" <<a href="mailto:ixpmanager-announce@inex.ie">ixpmanager-announce@inex.ie</a>></div>
<div>Cc "Barry O'Donovan (INEX)" <<a href="mailto:barry.odonovan@inex.ie">barry.odonovan@inex.ie</a>></div>
<div>Date 21/10/2026 12:50:53</div>
<div>Subject [ixpmanager] Critical PHP security release due today 14:00 UTC – please prepare to patch</div></div><div x-em-quote=""><br /></div>
<div id="xd1391a0b4484487"><blockquote cite="em8dd75c4a-c8f3-4dbd-8f85-9ff547eee2de@inex.ie" type="cite" class="cite2">
<div id="x765480b583cd4e8ea85762525784a52c"><div><br /></div><div>Hi all,<br /><br />A heads-up that the PHP security team has pre-announced a critical security release, scheduled for today, Wednesday 21 October 2026 at 14:00 UTC (15:00 Irish time):<br /><br /> <a href="https://www.php.net/archive/2026.php#2026-10-20-1" class="__cef_visited">https://www.php.net/archive/2026.php#2026-10-20-1</a><br /><br />It fixes two vulnerabilities, both rated critical (CVSS v4.0 9.2). Affected and fixed versions will only be confirmed with the release, but third-party reports (reported as CVE-2026-109618 and CVE-2026-109619, but these are not confirmed in the official PHP announcement) describe pre-authentication remote code execution in PHP's multipart/form-data request handling, potentially affecting all PHP versions from 5 onward. Details leaked before a fix was available, and mass exploitation is expected very soon after release.<br /><br />This is not an IXP Manager bug – but as IXP Manager v7 runs on PHP 8.4, every installation is likely affected, and the vulnerable code runs before IXP Manager (or Laravel) ever sees the request. Many of you run your IXP Manager portal on the public internet for members, so <b><u>please treat this as urgent</u></b>.<br /><br />What we recommend:<br /><br />1. Patch as soon as fixed packages are available. Distro and PPA builds may lag upstream by some hours. Restart Apache/PHP-FPM afterwards, and also restart any long-running PHP processes.<br /><br />2. In the meantime, consider the interim measures being circulated (<b><i><u>unofficial</u></i></b> – PHP's position is that the only real fix is upgrading):<br /><br /> - Disable session upload progress in your php.ini (not that some reports say this is insufficient):<br /><br /></div><div><span style="font-family: Courier New;"> session.upload_progress.enabled = Off</span><br /><br /> - Block multipart requests at the web server, for all HTTP methods. Example in the below link for Apache 2.4:</div><div><br /><span style="font-family: Courier New;"> <If "req('Content-Type') =~ /multipart/i”></span></div><div><span style="font-family: Courier New;"> Require all denied</span></div><div><span style="font-family: Courier New;"> </If></span></div><div><br /> This will break file uploads in IXP Manager (e.g. member logos) until removed – but this should be acceptable.<br /><br /> - If your portal doesn't need to be public, restrict it to trusted networks until patched.<br /><br />3. Don't forget other PHP on the same box or elsewhere in your IXP – route server tooling, other web apps, staging/dev instances, etc.<br /><br />4. Once patched, review web server logs for unusual multipart requests since ~15:00 UTC on 20 October.<br /><br />A good practical write-up of interim steps is here:<br /><br /> <a href="https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/" class="__cef_visited">https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/</a><br /><br /><br />Thanks,<br />Barry<br /><br /></div><div id="signature_old">
--<br />
Kind regards,
<br />
Barry O'Donovan
<br />
INEX</div><div id="signature_old"><br /></div></div><div class="plain">
<div class="plain_line">_______________________________________________</div>
<div class="plain_line">INEX IXP Manager mailing list</div>
<div class="plain_line"><a href="mailto:ixpmanager@inex.ie">ixpmanager@inex.ie</a></div>
<div class="plain_line">Unsubscribe or change options here: <a href="https://www.inex.ie/mailman/listinfo/ixpmanager">https://www.inex.ie/mailman/listinfo/ixpmanager</a></div>
</div></blockquote></div>
<div id="disallowmodify"></div></body></html>