{"id":443454,"date":"2026-10-21T19:59:12","date_gmt":"2026-10-21T17:59:12","guid":{"rendered":"https:\/\/www.glpi-project.org\/?p=443454"},"modified":"2026-10-21T19:59:12","modified_gmt":"2026-10-21T17:59:12","slug":"%f0%9f%9a%a8-critical-php2shell-php-vulnerabilities-cve-2026-109618-cve-2026-109619-what-you-need-to-know-for-your-glpi-server","status":"publish","type":"post","link":"https:\/\/www.glpi-project.org\/br\/%f0%9f%9a%a8-critical-php2shell-php-vulnerabilities-cve-2026-109618-cve-2026-109619-what-you-need-to-know-for-your-glpi-server\/","title":{"rendered":"\ud83d\udea8 Critical \"php2shell\" PHP Vulnerabilities (CVE-2026-109618 &amp; CVE-2026-109619): What you need to know for your GLPI server"},"content":{"rendered":"<p class=\"wp-block-paragraph translation-block\">On&nbsp;<strong>October 21, 2026, at 14:00 UTC<\/strong>,&nbsp;the PHP development team released critical security updates addressing two major vulnerabilities,&nbsp;tracked as&nbsp;<strong>CVE-2026-109618<\/strong>&nbsp;and&nbsp;<strong>CVE-2026-109619<\/strong>&nbsp;(commonly referred to as&nbsp;<em>\"php2shell\"<\/em>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Full technical details regarding these flaws,&nbsp;their potential security impact,&nbsp;and recommended workarounds can be found in the <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noreferrer noopener\">official&nbsp;PHP.net announcement<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is a breakdown of what this security advisory means for your ITSM infrastructure and how to secure your GLPI instances.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd12 Direct Impact on GLPI<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Key Takeaways:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\"><strong>GLPI is not directly affected<\/strong>: The core GLPI codebase does not contain these security flaws.<\/li>\n\n\n\n<li class=\"translation-block\"><strong>Your hosting servers are concerned<\/strong>: Because GLPI relies on PHP to run, any web server hosting a GLPI instance remains vulnerable until the server\u2019s underlying PHP engine is patched \u2014&nbsp;<strong>regardless of your GLPI version<\/strong>.<\/li>\n\n\n\n<li class=\"translation-block\"><strong>Updating GLPI alone is not enough<\/strong>: You must update the PHP package installed on your host system or application container.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">\u2601\ufe0f Are you using GLPI Network Cloud?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>No action is required on your part.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our Infrastructure and Cloud Security teams immediately deployed the necessary security patches across the entire platform upon disclosure.&nbsp;As of October 21,&nbsp;2026,&nbsp;at 14:00 UTC,&nbsp;every GLPI Cloud server is running a patched,&nbsp;secure PHP version.&nbsp;Our internal security monitoring has detected no signs of exploitation or compromise.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83c\udfe2 Self-Hosting GLPI (On-Premises)?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Please follow these remediation steps as soon as possible to safeguard your web servers:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li class=\"translation-block\"><strong>Check your web server\u2019s active PHP version:<\/strong>Inside GLPI,&nbsp;navigate to&nbsp;<strong>Setup &gt; General &gt; System<\/strong>.<em>(Note: The command-line interface command&nbsp;<code>php -v<\/code>&nbsp;checks the CLI version, which may differ from the PHP engine utilized by your web server or PHP-FPM service).<\/em><\/li>\n\n\n\n<li><strong>Apply the PHP update based on your environment:<\/strong>\n<ul class=\"wp-block-list\">\n<li><strong>Official Source Packages:<\/strong>&nbsp;Refer to the official&nbsp;PHP.net announcement.<\/li>\n\n\n\n<li><strong>Linux Distribution Packages (Debian, Ubuntu, Red Hat, etc.):<\/strong>&nbsp;Follow your distribution's security advisories,&nbsp;as security fixes are often backported without incrementing the primary version number.<\/li>\n\n\n\n<li><strong>Containers and Managed Hosting:<\/strong>&nbsp;Deploy updated base images or follow your provider\u2019s security instructions.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li class=\"translation-block\"><strong>Restart your web services:<\/strong>Restart your web server (Apache,&nbsp;Nginx) or&nbsp;<strong>PHP-FPM<\/strong>&nbsp;pool manager to load the patched PHP binaries into memory.<\/li>\n\n\n\n<li class=\"translation-block\"><strong>Unsupported PHP Versions (End-of-Life):<\/strong>Legacy PHP versions will not receive vendor security patches.&nbsp;Review the list of&nbsp;supported PHP versions.&nbsp;Before upgrading your PHP runtime to a newer major release,&nbsp;verify system requirements against the&nbsp;<a href=\"https:\/\/help.glpi-project.org\/documentation\" target=\"_blank\" rel=\"noreferrer noopener\">GLPI Documentation<\/a>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a0\ufe0f Workarounds &amp; compromise indicators<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you cannot immediately deploy the PHP security update:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\">Rely exclusively on official security advisories (from <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" data-type=\"link\" data-id=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" rel=\"noreferrer noopener\">PHP.net<\/a>,&nbsp;your Linux distribution maintainers,&nbsp;or hosting provider) for valid mitigation strategies.<\/li>\n\n\n\n<li>Monitor server logs for potential exploitation indicators provided by your SecOps team or security vendors.<\/li>\n\n\n\n<li>If you suspect your host environment has been compromised,&nbsp;isolate the instance and contact your internal IT security team immediately.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Using Official GLPI Docker Images<\/h2>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">We have rebuilt the official GLPI Docker images for versions&nbsp;<code>main<\/code>,&nbsp;<code>12<\/code>,&nbsp;<code>11<\/code>, and&nbsp;<code>10<\/code>: they now include a patched version of PHP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">To apply this update, pull the new image and recreate your containers\u2014for example, using&nbsp;<code>docker compose pull<\/code>&nbsp;followed by&nbsp;<code>docker compose up -d<\/code>. Simply restarting an existing container is not enough: it will continue using the old image. Your data remains safe if stored in volumes, as specified in the recommended setup.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udce2 Next steps &amp; resources<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\">Read the&nbsp;<a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noreferrer noopener\">Official PHP Security Announcement<\/a><\/li>\n\n\n\n<li class=\"translation-block\">Review the&nbsp;<a href=\"https:\/\/help.glpi-project.org\/faq\/glpi\/installation_update\" target=\"_blank\" rel=\"noreferrer noopener\">GLPI Official Installation &amp; Prerequisites Guide<\/a><\/li>\n\n\n\n<li class=\"translation-block\">Explore&nbsp;<a href=\"https:\/\/www.glpi-project.org\/br\/pricing\/\" target=\"_blank\" rel=\"noreferrer noopener\">GLPI Network Cloud Services<\/a>&nbsp;for fully managed,&nbsp;hassle-free ITSM security.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button translation-block\">Read the&nbsp;<a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noreferrer noopener\">Official PHP Security Announcement<\/a><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>On&nbsp;October 21, 2026, at 14:00 UTC,&nbsp;the PHP development team released critical security updates addressing two major vulnerabilities,&nbsp;tracked as&nbsp;CVE-2026-109618&nbsp;and&nbsp;CVE-2026-109619&nbsp;(commonly referred to as&nbsp;\"php2shell\"). Full technical details regarding these flaws,&nbsp;their potential security impact,&nbsp;and recommended workarounds can be found in the official&nbsp;PHP.net announcement. Here is a breakdown of what this security advisory means for your ITSM infrastructure and how [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":443462,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[153],"tags":[],"class_list":["post-443454","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-produits"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/posts\/443454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/comments?post=443454"}],"version-history":[{"count":7,"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/posts\/443454\/revisions"}],"predecessor-version":[{"id":443470,"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/posts\/443454\/revisions\/443470"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/media\/443462"}],"wp:attachment":[{"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/media?parent=443454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/categories?post=443454"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.glpi-project.org\/br\/wp-json\/wp\/v2\/tags?post=443454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}