Dear Customer, Dear Users
The PHP project has released security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may allow unauthenticated remote code execution.
Centreon Cloud customers
Following the announcement, Centreon immediately applied the temporary mitigations recommended by PHP. These changes were deployed without any observed impact on the service.
Once the corrected packages became available, they were tested and validated before being deployed across all Centreon Cloud environments.
All Centreon Cloud environments are now up to date and protected. No action is required from Centreon Cloud customers.
Centreon On-Premise customers - action required
PHP is not supplied, packaged or maintained by Centreon. It is installed through the packages provided by your Linux distribution or the community repository used by your organisation.
For on-premise installations, the administration and maintenance of the operating system and its dependencies, including PHP, therefore remain the customer’s responsibility.
We strongly recommend that you:
- Review the security advisories published by your Linux distribution or package provider.
- Install without delay the PHP packages addressing CVE-2026-109618 and CVE-2026-109619.
- Restart all affected PHP services and workers.
- Confirm with your package provider that the fixes have been included, including when they have been backported without changing the main PHP version number.
- Validate the correct operation of your Centreon platform after the update.
The fixed upstream PHP versions are:
- PHP 8.2.35;
- PHP 8.3.36;
- PHP 8.4.27;
- PHP 8.5.12.
Your Linux distribution may provide these fixes under a different package version through security backports.
Temporary mitigations if an immediate update is not possible
If the corrected packages are not yet available or cannot be installed immediately, PHP recommends measures including:
- configuring memory_limit=-1 at PHP-FPM pool or server level, together with an appropriate system, container or cgroup resource limit;
- reducing post_max_size to the lowest value compatible with your usage and keeping upload_max_filesize below this value;
- disabling session.upload_progress.enabled;
- removing or correcting invalid or deprecated PHP settings applied on a per-request basis;
- restricting the size and complexity of incoming requests at the web server or reverse-proxy level;
- restarting all PHP workers after applying these changes.
These mitigations must be assessed, tested and implemented under the responsibility of the administrator of the on-premise platform.
They only reduce exposure to specific attack paths and do not provide complete protection. Updating the PHP packages remains the only recommended complete remediation.
We therefore strongly recommend applying the corrected packages as soon as they become available from the distribution or community repositories used by your platform.
The official PHP advisory is available here: PHP Security Advisory – Critical remote code execution vulnerabilities
Alma: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
RedHat: https://access.redhat.com/errata/RHSA-2026:87072
Debian 13: DSA-6574-1 — php8.4 security update
Debian 12: DLA-4848-1 — php8.2 security update
For assistance with Centreon platform compatibility, please contact Centreon Support and provide your Centreon version, Linux distribution and installed PHP package version.
Kind regards,
Centreon Security Team
