Major PHP security issue

The temporary mitigations have been removed and the incident is now considered fully resolved.

The PHP security updates have now been deployed for PHP versions 7.3 to 8.1 as well. Some mitigations/restrictions will remain in place until it has been fully validated.

PHP security updates have been deployed for PHP versions 8.2 to 8.5. We are still working to get fixes out for customers on legacy versions.

The PHP development team has released security updates addressing the two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

These vulnerabilities affect PHP's internal memory and request handling and could potentially allow unauthenticated attackers to execute code on affected servers.

The security fixes are included in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

We have already implemented temporary security mitigations to reduce exposure and are now actively rolling out the patched PHP versions across the Servebolt infrastructure.

Our engineering team is closely monitoring the deployment and will provide further updates as the rollout progresses.

We are aware of a major PHP security issue without a published upstream fix.
Curently known mitigations have been enabled and the full patch will be deployed as soon as it is available.