Security notice: critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

[LucaGiardi20]

On 21 October 2026 the PHP project released emergency security updates for two critical remote code execution vulnerabilities (both CVSS v4.0 9.2):

• CVE-2026-109618 — RCE via out-of-memory (OOM) corruption (GHSA-w8hw-w9fx-j79w)
• CVE-2026-109619 — RCE via stale global state (GHSA-6wmf-4rv5-p3rp)

These are bugs in PHP itself, not in Externa, but every Externa install runs on PHP, so please update.

Affected and fixed versions

PHP branch	Affected	Fixed in
8.2	< 8.2.35	8.2.35
8.3	< 8.3.36	8.3.36
8.4	< 8.4.27	8.4.27
8.5	< 8.5.12	8.5.12

Externa requires PHP 8.4+ (^8.4), so you need PHP 8.4.27 or 8.5.12 or later.

What to do

• Herd / bare metal: update PHP to 8.4.27 (or 8.5.12), then restart PHP-FPM, Horizon, Reverb and the scheduler. Check with php -v.
• Official Docker image (ghcr.io/qiick-io/externa-core): The 1.2.1 image (and latest) has been rebuilt on PHP 8.4.27. Pull ghcr.io/qiick-io/externa-core:1.2.1 again and recreate the containers (docker compose pull && docker compose up -d), then check with docker compose exec <php-service> php -v.
• Building from source with the Dockerfile: rebuild with --pull --no-cache so you pick up the updated php:8.4-fpm-bookworm base (PHP 8.4.27).

If you can't update right away

Updating PHP is the only complete fix. The PHP advisories list these partial mitigations:

• Set memory_limit=-1 in the server-level PHP config (php.ini / FPM pool, not per-directory), restart every worker, and rely on a container or cgroup memory limit instead. Do not use RLIMIT_AS/RLIMIT_DATA.
• Keep post_max_size conservative, enforce request size at your reverse proxy, and limit multipart parts, headers per part, uploads and max_input_nesting_level. If you don't need multipart uploads on a route, block them at the proxy.
• Set session.upload_progress.enabled=0 and restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
• Optionally, pm.max_requests=1 in PHP-FPM if performance allows.

Note: Externa's file uploads use multipart requests, so blocking multipart entirely will break uploads in the admin.

Coming in Externa 1.2.2

Externa 1.2.2 will ship additional php.ini hardening for the official image (#216).