Critical PHP Vulnerabilities - Security Advisory - CVE-2026-109618 and CVE-2026-109619
Maintenance #54
Two critical vulnerabilities affecting PHP (CVE-2026-109618 and CVE-2026-109619) have been reported. They could allow unauthenticated remote code execution.
Our teams are assessing our platform’s exposure and will deploy the fixes as soon as they are released, which is expected on October 21, 2026 at 4:00 p.m. (Paris time).
As a precaution, we may need to temporarily suspend some PHP instances to protect your applications and data. If you have not already done so, we strongly urge you to migrate to the latest supported PHP versions as soon as possible.
We are monitoring the situation closely and will take the necessary steps to limit the risks while keeping the impact on your services to a minimum.
We will keep you informed of any significant developments.
More information: https://cert.europa.eu/publications/security-advisories/2026-018/
Best regards,
Updates
FS Bucket File Explorer temporarily disabled
As part of the ongoing maintenance, we have temporarily disabled the File Explorer tab in the FS Bucket add-on dashboard.
This feature will be re-enabled once the maintenance is complete.
PHPMyAdmin temporarily disabled for MySQL add-ons
As part of the ongoing maintenance, we have temporarily disabled phpMyAdmin for MySQL add-ons.
This feature will be re-enabled once the maintenance is complete.
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are built, we're pushing the release of images for Apps to be deployed. We expect the production to be fully rolled out for 6PM.
Backports are currently being worked on for 7.4, 8.0 and 8.1.
Mitigations have been deployed on all PHP runtimes against CVE-2026-109618 and CVE-2026-109619, while images with patched PHP versions are being rolled out.
The mitigation disables session.upload_progress.enabled, which blocks the demonstrated multipart upload exploitation path. It significantly reduces exposure but does not cover every variant; only the patched versions fully fix both vulnerabilities.
No complete exploit has been demonstrated against PHP-FPM so far, and we keep monitoring for new exploitation paths.
Detailed changelog has been published for further information : https://www.clever.cloud/developers/changelog/2026/10-21-php-security-vulnerabilities/
Disabled services are progressively being enabled back
An issue has been identified with new images that may cause looped deployment. A fix has been pushed and new images being rolled. While new images are being rolled out, a rollback has been issued to prevent applications unstability.
The fixes for CVE-2026-109618 and CVE-2026-109619 have been applied to PHP on Clever Cloud, including the end-of-life 7.4, 8.0 and 8.1 branches. We are now redeploying PHP applications to roll out the patched versions.
More information: https://www.clever.cloud/developers/changelog/2026/10-21-php-eol-security-backport/
We deployed a new PHP image, primarily to fix issues with the Elastic APM extension. See https://github.com/elastic/apm-agent-php/pull/1510 for more details.