---
title: "PHP Security Advisory: CVE-2026-109618 and CVE-2026-109619 | DreamFactory Docs"
source: "https://docs.dreamfactory.com/Security/php-cve-2026-109618-109619"
canonical_url: "https://docs.dreamfactory.com/Security/php-cve-2026-109618-109619"
converted_at: "2026-10-21T19:08:53.172Z"
format: "markdown"
converted_by: "html-to-md-ai"
---
On October 21, 2026, the PHP project released fixes for two critical remote code execution vulnerabilities in PHP itself. Both are rated CVSS 9.2. An attacker does not need to log in to exploit them.

The flaws are in PHP, not in DreamFactory code. Every DreamFactory instance runs on PHP, so treat every instance as affected until its PHP is updated.

Updating PHP is the only complete fixThe configuration changes in [Temporary mitigation](#temporary-mitigation) reduce your exposure, but they do not fix either vulnerability. Plan to update PHP as soon as a patched build is available for your platform.

## Fixed PHP versions[​](#fixed-php-versions)

PHP branchFixed inStatus8.58.5.12Supported8.48.4.27Supported8.38.3.36Supported8.28.2.35Security fixes end December 31, 20268.1 and olderNo fixEnd of life

PHP's technical advisories:

- [GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)

- [GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)

- [PHP release announcements, October 21, 2026](https://www.php.net/archive/2026.php)

The advisories explain how each flaw works, which server setups are most exposed and which settings reduce the risk. PHP has not published reproduction steps or a test case. To check your own instance, use [Confirm the version your web server runs](#confirm-the-version-your-web-server-runs) below.

## Step 1: Find your current versions[​](#step-1-find-your-current-versions)

You need three facts: how DreamFactory is deployed, which DreamFactory version runs, and which PHP version the web server uses.

**DreamFactory version.** From the DreamFactory root directory (usually `/opt/dreamfactory`):

```
grep "'version'" config/app.php
```

**PHP version.** Run `php -v` for a first look, but it shows the command line PHP. Your web server can run a different build. Confirm the web server's version as described in [Confirm the version your web server runs](#confirm-the-version-your-web-server-runs).

## Step 2: Find your upgrade path[​](#step-2-find-your-upgrade-path)

Your DreamFactory version decides which PHP versions it can run on:

DreamFactory versionRequired PHP7.0.1 and later8.3 or later5.0.0 to 7.0.08.1 (declared; see [Upgrade DreamFactory](#upgrade-dreamfactory))4.x7.2 to 7.4

Find the first row below that matches your instance.

Your instancePathDocker or Kubernetes[Docker and Kubernetes](#docker-and-kubernetes)Linux, DreamFactory 7.0.1 or later, PHP 8.2 or later[Update PHP in place](#update-php-in-place)DreamFactory 5.0.0 to 7.0.0 (PHP 8.0 or 8.1)[Upgrade DreamFactory](#upgrade-dreamfactory), or as a stopgap [move to a supported PHP version](#move-to-a-supported-php-version)PHP 5.x or 7.x (DreamFactory 4.x or older)[Move to a new instance](#move-to-a-new-instance)Windows[Windows](#windows)

### Docker and Kubernetes[​](#docker-and-kubernetes)

The DreamFactory Docker image includes PHP. You update PHP by rebuilding or pulling the image. Updated images are in progress; this page will list the image tags when they are published.

When the updated image is available, rebuild with `--pull`. Without it, Docker reuses the cached base image and you keep the old PHP:

```
docker compose build --pull webdocker compose up -d
```

Then [confirm the version your web server runs](#confirm-the-version-your-web-server-runs).

Keep the base image and the df-docker version togetherThe `Dockerfile` and `docker-entrypoint.sh` in each df-docker release name a specific PHP version in their paths and service names, for example `/etc/php/8.5/fpm/pool.d/www.conf` and `php8.5-fpm`. df-docker 7.0 through 7.5 use PHP 8.3. df-docker 7.6 and later use PHP 8.5.

Do not change only the `FROM` line to a newer base image. If the base image moves from PHP 8.3 to PHP 8.5 while your entrypoint still starts `php8.3-fpm`, the container does not start. Rebuild with the base image your df-docker release already names, or check out a newer df-docker release so the `Dockerfile`, entrypoint and base image match.

If you added your own PHP settings to the `Dockerfile` or entrypoint, such as the [temporary mitigation](#temporary-mitigation) values, check that their paths match the PHP version in the new image.

Related guides:

- [Docker installation](/getting-started/installing-dreamfactory/docker-installation)

- [Helm installation](/getting-started/installing-dreamfactory/helm-installation)

### Update PHP in place[​](#update-php-in-place)

This path is for Linux installs on PHP 8.2, 8.3, 8.4 or 8.5. You stay on the same PHP branch and install the patch release. You do not need new composer files, and DreamFactory itself does not change.

**Ubuntu and Debian.** The DreamFactory installer gets PHP from the [Ondřej Surý PPA](https://launchpad.net/~ondrej/+archive/ubuntu/php). Patched builds are being published there now. When `apt` offers the fixed version, update PHP and fully restart PHP-FPM. Replace `8.3` with your PHP branch:

```
sudo apt updatesudo apt install --only-upgrade 'php8.3*'sudo systemctl restart php8.3-fpm
```

If your server uses Apache with `mod_php`, restart Apache instead:

```
sudo systemctl restart apache2
```

**PHP from your distribution's own repository.** If your PHP comes from the standard Ubuntu, Debian or Red Hat repositories instead of the Ondřej PPA or Remi, the fix arrives as a distribution security update. These updates often keep the old PHP version number, for example Ubuntu 24.04 ships PHP 8.3.6 and patches it in place. Watch your distribution's security notices for CVE-2026-109618 and CVE-2026-109619, then install the update the same way.

**RHEL, Rocky Linux, AlmaLinux and Oracle Linux.** The DreamFactory installer gets PHP from the [Remi repository](https://rpms.remirepo.net/), which has published the fixed 8.2, 8.3, 8.4 and 8.5 builds. Use `--refresh` so `dnf` reads the latest package list instead of a cached one:

```
sudo dnf upgrade --refresh 'php*'sudo systemctl restart php-fpm
```

Remi's mirrors are under heavy load. If `dnf` reports timeouts or offers no PHP update, wait a few minutes and run it again.

If your PHP comes from the Red Hat AppStream modules instead of Remi, check with your distribution for the patch date, or move to Remi or Docker.

Restart, do not reloadFor PHP-FPM, a reload can leave running workers on the old code and settings. Use `restart`, then confirm the new version.

Then [confirm the version your web server runs](#confirm-the-version-your-web-server-runs).

### Move to a supported PHP version[​](#move-to-a-supported-php-version)

PHP 8.0 and 8.1 will not get a fix. Install PHP 8.3 or later alongside your current PHP, point the web server at it, and remove the old version. Any PHP extensions you added by hand, such as SQL Server or Oracle drivers, must be installed again for the new PHP version.

Related guides:

- [Installing additional drivers](/getting-started/installing-dreamfactory/installing-additional-drivers)

- [Linux installation](/getting-started/installing-dreamfactory/linux-installation)

### Upgrade DreamFactory[​](#upgrade-dreamfactory)

DreamFactory 5.0.0 through 7.0.0 declare PHP 8.1, which will not get a fix. The long-term path is to upgrade DreamFactory to 7.7.1 on PHP 8.3 or later.

If you cannot upgrade DreamFactory right away, these versions can run on a fixed PHP 8.3 as a stopgap. We started DreamFactory 5.4.0 on PHP 8.3 with `composer install --ignore-platform-reqs` and confirmed that admin login and the system API work. We have not tested every connector or script type, so test your own services on a staging copy before you change production. Commercial installs need the composer files for the target version; request them from DreamFactory support before you start.

Related guide:

- [Upgrading and Migrating DreamFactory](/upgrades-and-migrations/upgrading-and-migrating-dreamfactory)

### Move to a new instance[​](#move-to-a-new-instance)

PHP 5.x and 7.x are end of life and will not get a fix. DreamFactory versions that run on them are also several major versions behind. Build a new DreamFactory 7.7.1 instance on a supported PHP version, move your configuration across, then switch traffic to it.

Related guide:

- [Major Version Migration: migration process](/upgrades-and-migrations/upgrading-and-migrating-dreamfactory#migration-process)

### Windows[​](#windows)

Download the fixed release for your PHP branch from [windows.php.net](https://windows.php.net/download/), replace your PHP installation, then restart IIS or the FastCGI application pool.

Related guide:

- [Upgrading PHP on Windows](/upgrades-and-migrations/upgrading-php-on-windows)

## Confirm the version your web server runs[​](#confirm-the-version-your-web-server-runs)

`php -v` reports the command line PHP. To see the PHP that serves DreamFactory, ask DreamFactory itself. Log in as an administrator, then call the environment endpoint:

```
curl -s https://your-instance/api/v2/system/environment \  -H "X-DreamFactory-Session-Token: YOUR_ADMIN_SESSION_TOKEN"
```

In the JSON response, `php.core.php_version` is the version the web server runs. If your PHP comes from the Ondřej PPA, Remi, the Docker image or php.net, it must be a fixed version from the [table above](#fixed-php-versions). If it comes from your distribution's own repository, the version number may not change; check the installed package against your distribution's security notice instead. The same response shows the settings from [Temporary mitigation](#temporary-mitigation), so you can confirm those too:

- `php.session["session.upload_progress.enabled"]`

- `php.core.memory_limit`

- `php.core.fatal_error_backtraces` (PHP 8.5)

## Temporary mitigation[​](#temporary-mitigation)

Use these steps only until you can update PHP. They reduce the risk. They do not remove it.

1. **Restrict network access.** If the instance is reachable from the internet, limit access with a firewall rule, IP allowlist or VPN.

2. **Change PHP settings.** Set these in the `php.ini` that your web server loads, not the command line one. For PHP-FPM on Ubuntu this is `/etc/php/8.x/fpm/php.ini`. For Apache with `mod_php` it is `/etc/php/8.x/apache2/php.ini`.

```
session.upload_progress.enabled = Off; PHP 8.5 only:fatal_error_backtraces = Off
```

PHP's advisory for CVE-2026-109618 also names `memory_limit = -1` as the main setting for installs that cannot update. Read the advisory before you use it: it removes PHP's per-request memory cap, so a single request can use as much memory as the server allows.

3. **Fully restart PHP.** Restart PHP-FPM, or Apache if it runs `mod_php`. A reload is not enough. Setting these values with `ini_set()` or `.user.ini` does not work.

4. **Confirm.** Check the values as described in [Confirm the version your web server runs](#confirm-the-version-your-web-server-runs).

`session.upload_progress.enabled = Off` blocks one confirmed attack path for CVE-2026-109619. It does nothing for CVE-2026-109618. DreamFactory does not use PHP session upload progress, so turning it off does not affect DreamFactory features.

## Questions[​](#questions)

Commercial customers can reply to the advisory email or contact DreamFactory support. Tell us your deployment type, DreamFactory version and PHP version, and we will help you plan the upgrade.