MONARC - securityhttps://www.monarc.lu/2026-10-23T00:00:00+02:00PHP runtime security notice for MONARCÂ deployments2026-10-23T00:00:00+02:002026-10-23T00:00:00+02:00Luxembourg House of Cybersecuritytag:www.monarc.lu,2026-10-23:/news/2026/10/23/php-runtime-security-notice/<p>Update affected <span class="caps">PHP</span> web runtimes for <span class="caps">CVE</span>-2026-109618 and <span class="caps">CVE</span>-2026-109619.</p><p>The reported vulnerabilities affect the <span class="caps">PHP</span> runtime, not the <span class="caps">MONARC</span> application
code itself. However, <span class="caps">MONARC</span> installations using an affected <span class="caps">PHP</span> version to
serve web requests may be exposed.</p>
<p>Please apply your operating system or vendor security update for
<strong><span class="caps">CVE</span>-2026-109618</strong> and <strong><span class="caps">CVE</span>-2026-109619</strong>, then restart the affected web
server or <span class="caps">PHP</span> workers.</p>
<p>For Ubuntu, see the
<a href="https://ubuntu.com/security/notices/USN-8948-1">Ubuntu Security Notice <span class="caps">USN</span>-8948-1</a>.
In particular, Ubuntu 22.04 installations using <span class="caps">PHP</span> 8.1 should update to
Ubuntu package version <code>8.1.2-1ubuntu2.28</code> or later.</p>
<p>Please verify the <span class="caps">PHP</span> runtime used by the web server, not only the <span class="caps">CLI</span> version.
This applies to Apache mod_php, <span class="caps">PHP</span>-<span class="caps">FPM</span>, <span class="caps">CGI</span>, and other <span class="caps">PHP</span> web SAPIs.</p>
<p>For other operating systems, follow the relevant vendor security advisory and
ensure it explicitly addresses both CVEs.</p>
<p>More information is available in
<a href="https://www.circl.lu/pub/tr-102/"><span class="caps">CIRCL</span> <span class="caps">TR</span>-102</a>.</p>