Dear Customers and users,
On October 20, 2026, the PHP Security Team announced the upcoming release of fixes for two critical vulnerabilities in PHP, both rated CVSS 9.2 and publicly referenced as CVE-2026-109618 and CVE-2026-109619.
As Centreon Infra Monitoring relies on PHP, our Security and R&D teams have initiated an immediate assessment to determine:
- which Centreon versions and supported environments may be affected;
- whether the vulnerabilities are exploitable through a standard Centreon deployment;
- which security updates or mitigating measures may be required.
At the time of this notice, the PHP Security Team has not yet published the complete technical details, confirmed affected versions or fixed releases. We therefore cannot yet confirm that Centreon installations are exploitable.
We are not currently aware of any exploitation specifically targeting Centreon products through these vulnerabilities.
As a general security reminder, Centreon platforms must be kept fully up to date. This includes not only Centreon packages, but also the operating system and all third-party components and dependencies used by the platform.
Centreon does not provide or maintain the PHP packages installed on user platforms. PHP security updates must therefore be obtained and applied through the operating-system distribution repositories or the community repositories configured in accordance with the relevant Centreon installation documentation. Updating Centreon packages alone will not update PHP or every third-party component on which the platform relies.
Until our assessment is complete, we recommend that users:
- ensure their Centreon platform, operating system and third-party dependencies are fully up to date;
- verify which PHP version and package repository are currently in use;
- prepare to apply the forthcoming PHP security updates as soon as they are made available by their distribution or configured community repository;
- ensure access to the Centreon web interface is restricted to authorised users and trusted networks wherever possible;
- maintain existing network protections, reverse proxies and web application firewall controls;
- monitor web server, PHP-FPM, authentication and system logs for unusual activity;
- avoid applying unofficial patches or unverified workarounds.
The official PHP security release is expected on October 21, 2026, at 14:00 UTC. Centreon will review the information as soon as it becomes available and will issue an updated security advisory specifying the affected Centreon versions and required remediation, if applicable.
Users requiring assistance may contact Centreon Support through the usual channels.
Best regards,
Centreon Security Team