Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP have been announced yesterday and patched today in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Any application running on PHP on your server is at risk. Fixed PHP packages are now available so you need to perform YunoHost system upgrade as soon as possible.
via the Web UI: go at https://domain.tld/yunohost/admin/#/update, click “Retrieve available updates”, and then “Upgrade” under the “System” section
via SSH: sudo yunohost tools update && sudo yunohost tools upgrade system
Was your server affected? You can tell by running below command via SSH. If it returns any line starting with php, then your server run some PHP applications.
Deux failles critiques (CVE-2026-109618 and CVE-2026-109619) dans PHP ont été annoncées hier et corrigées aujourd’hui via les versions PHP 8.5.12, 8.4.27, 8.3.36 et 8.2.35
Toute application tournant avec PHP installée sur votre serveur présente un risque. Les correctifs sont désormais disponibles et vous devriez mettre à jour les paquets système de votre instance YunoHost dès que possible.
via l’interface web: allez sur https://domaine.tld/yunohost/admin/#/update, cliquez sur “Récupérer les mises à jours disponibles”, puis sur “Mettre à jour” sous la section “Système”.
via SSH: sudo yunohost tools update && sudo yunohost tools upgrade system
Votre serveur a-t-il été vulnérable? Vous pouvez le savoir rapidement en exécutant la commande suivante via SSH. Si elle retourne au moins une ligne commençant avec php, cela signifie que votre serveur fait tourner des applications PHP.
Par contre j’ai également reçu des MàJ pour d’autres versions de PHP (7.4, 8.0, 8.1).
Je suppose que ça n’a rien à voir avec les vulnérabilités dont on parle ici. Il y a moyen de savoir quelle version de PHP est utilisée par quelle application ?
Hello,
Thanks for the quick response!
However, I’ve also received updates for other versions of PHP (7.4, 8.0, 8.1).
I assume this has nothing to do with the vulnerabilities we’re discussing here. Is there a way to find out which version of PHP is being used by each application?
Thanks for the good work, and thanks to the community to be on the ball today !
Same question as @Yop above, do you know if legacy packages have been patched as well ?
A quick apt-cache policy php7.4-fpm tells Ondrej pushed an update today but can you confirm that’s it ? I’d rather not gamble my server
L’équipe liste des mesures pour atténuer les risques dans certains cas, mais ajoute qu’aucune protection n’est réellement valable en dehors de l’installation des correctifs. En outre, au vu de la situation, elle a décidé de rétroporter les sources pour PHP 7.4, 8.0 et 8.1, des versions hors maintenance. Dans ces cas, il faudra compiler soi-même le code.
En sachant que j’ai utilisé l’outil de mise à jour de Yunohost, ce serait Debian qui aurait compilé le code et mis à dispo les nouvelles versions ?
The team lists measures to mitigate risks in certain cases, but adds that no protection is truly effective apart from installing the patches. Furthermore, given the situation, they have decided to backport the source code for PHP 7.4, 8.0, and 8.1—versions that are no longer under active maintenance. In these cases, you’ll need to compile the code yourself.
Since I used the Yunohost update tool, does that mean Debian compiled the code and made the new versions available?
simplest way to check which app uses what is to run
ls /var/run/php
to list the running unix sockets used by php. The socket filenames give you the versions and the appname. With the huge caveat that potentially exploitable apps have to be running
Je ne sais pas si Debian a mis à jour les packages 7.4, 8.0 et 8.1, mais sur mon Yunohost, ces packages viennent du repo sury.org géré par Ondrej Sury et pas du repo debian. Ondrej a mis à jour les packages pour toutes les versions qu’il propose aujourd’hui donc je pense que c’est bon pour ce repo (et j’imagine qu’a minima Debian a fait pareil) mais je ne trouve pas de confirmation
Je ne suis pas familier avec apt autoremove mais si je comprends bien, c’est plutôt pour supprimer les dépendances qui ne servent plus à rien, pas les précédentes versions d’un package encore installé. Pour ça il y a (je crois, je connais pas bien) :
apt-get autoclean
Le mieux étant de tester avec le switch --dry-run pour juste simuler ce que ferait la commande
Possibly a silly question, but are YunoHost PHP version and my VPS version two separate things? Asking to understand if I should upgrade my VPS separately or if YH manage that under the hood.
I did the latest upgrade( thanks to the devs for the quick patch release), and I just wondering if php7.4-fpm is still needed as a dependency in YunoHost 12.1.41.2 (stable) ? Is it safe to remove, if so, how?
It seems that versions before PHP 8.2 no longer receive security updates and PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. PHP: News Archive - 2026
For now I just stopped the service php7.4-fpm from the admin UI just to be safe.
yep, I did that already, I was wondering if I had to update it separately on the VPS by sshing in it
thought of that because i saw the version is 8.2.35, which is EOL
An easy way to check if you have the fix is to inspect which versions of the PHP packages you have installed:
$ sudo apt list --installed | grep -E 'php.../'
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
php8.3/bookworm,now 8.3.36-1+0~20261021.88+debian12~1.gbp250f7c all [installed,automatic]
php8.4/bookworm,now 8.4.27-1+0~20261021.57+debian12~1.gbp7636b9 all [installed,automatic]
php8.5-phpdbg/bookworm,now 8.5.11-1+0~20260924.26+debian12~1.gbpbcb504 armhf [installed,automatic]
php8.5/bookworm,now 8.5.12-1+0~20261021.27+debian12~1.gbp1a3e8a all [installed,automatic]
Here, I see 8.3.36, 8.4.27 and 8.5.12 so this is good (based on the versions given in the original message at the top of the thread).
Here is the result of the audit of PHP versions used by one or more apps currently listed in YNH catalog, and associated version of the patched package in the Sury repository from which YunoHost upgade tool fetches them (the version string refers to PHP package, e.g. php8.5, not PHP extension packages, e.g. php8.5-fpm):
In case your server runs custom or deprecated apps, you might see upgrades for the “not used” versions which are also provided by the Sury repo anyway.
To check whether your system has been patched, above version strings should be equal (or inferior) to the version strings in the output of the following command to execute on your server:
Can the Unattended-upgrades package install system updates automatically?
If yes, how do we configure it?
Thank you so much for your continued dedication!
Aside from the custom app case described by @ljf, you might want to make sure you did not miss an app which requires the given PHP version:
First check that all FPM-related services are running
Then, as suggested by @trankzen here above, run ls /var/run/php.
Another possibility is that the given PHP version was not removed when it should have been when you uninstalled the only package that was making use of it, due to this bug: Apt packages not uninstalled after app removal · Issue #2868 · YunoHost/issues · GitHub
However, waiting for a fix, that should not be too worrying at the moment as far as PHP packages are concerned, therefore I would recommend not to remove these specific packages manually for now.
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP have been announced yesterday and patched today in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Deux failles critiques (CVE-2026-109618 and CVE-2026-109619) dans PHP ont été annoncées hier et corrigées aujourd’hui via les versions PHP 8.5.12, 8.4.27, 8.3.36 et 8.2.35
