Testimonials
What our customers say about Team Password Manager

Two Critical PHP Vulnerabilities Oct 21 2026: CVE-2026-109618 and CVE-2026-109619

Critical PHP Security Vulnerabilities: CVE-2026-109618 and CVE-2026-109619

October 21, 2026

The PHP development team has announced two critical security vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619.

Both vulnerabilities have been assigned a CVSS v4.0 severity score of 9.2 (Critical). According to preliminary reports from security researchers, they could potentially allow remote code execution (RCE) on affected servers.

An emergency PHP security release is scheduled for October 21, 2026, at 14:00 UTC.

What is known so far?

The PHP security team has confirmed the existence of two critical vulnerabilities and has urged administrators to prepare to update their PHP installations as soon as security patches become available.

Security researchers have reported that:

  • The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
  • Both have a CVSS v4.0 score of 9.2.
  • They may allow remote code execution.
  • PHP versions dating back to PHP 5 may be affected.

At the time of writing, the PHP development team has not yet published the full technical details, the definitive list of affected versions, or the versions containing the fixes.

What does this mean for Team Password Manager?

Team Password Manager is a self-hosted application that runs on PHP. Consequently, the security of the PHP installation is an important part of the overall security of a Team Password Manager deployment.

These vulnerabilities concern PHP itself, rather than a vulnerability specifically identified in Team Password Manager.

However, depending on the affected PHP components and the conditions required for exploitation, installations running vulnerable PHP versions could potentially be exposed.

Since Team Password Manager stores sensitive information, including passwords and other credentials, we recommend treating these PHP security updates as a high priority.

Recommended actions

We recommend that all Team Password Manager administrators take the following steps:

  1. Identify your PHP version. Check which PHP version is running on the server hosting Team Password Manager.
  2. Apply the temporary mitigation below.
  3. Monitor the official PHP security announcement. Review the affected versions and fixed releases as soon as the PHP team publishes them.
  4. Update PHP as soon as a security fix is available. Install the appropriate patched version using your operating system's package manager or your usual PHP distribution channel.
  5. Review your server exposure. Ensure that your installation is protected by appropriate network access controls, particularly if it is accessible from the internet.
  6. Verify the application after updating. Confirm that Team Password Manager and its required PHP extensions operate correctly after the PHP upgrade.

For installations using Docker, administrators should ensure that their container image includes a patched PHP version once it becomes available. We'll also update the latest image when the patch becomes available.

Temporary mitigation

While waiting for the official PHP security patches, administrators may consider disabling PHP's session upload progress feature.

This feature is enabled by default in PHP and can be disabled by adding the following directive to the PHP configuration file (php.ini):

session.upload_progress.enabled = Off

Restart Apache or PHP-FPM after applying the change, and verify that the setting is disabled in the PHP configuration used by the web application.

Disabling this feature does not affect normal PHP sessions or file uploads, only the built-in upload progress tracking functionality.

Important: This is a precautionary measure suggested by security researchers, not an officially confirmed mitigation. It may not protect against both vulnerabilities and must not be considered a substitute for installing the official PHP security updates as soon as they become available.

Further information

We recommend following these official sources for the latest information:

We will continue monitoring these vulnerabilities and recommend that all administrators keep their PHP environments up to date.

Oct 21 2026 by Ferran Barba