🇬🇧 Serious security vulnerability in PHP, update required - customer information 21.10.2026

[bbegw]

Dear everyone,

There are currently two potentially serious security vulnerabilities in PHP, which are apparently already being exploited for attack scenarios. A PHP security update is expected around 16:00 CEST (14:00 UTC), which we will also immediately provide via new docker containers (packages). These must be actively applied so that they become effective immediately!

Additionally, there is a “potentially helpful mitigation” for the announced PHP security update, which disables a functionality not used by EGroupware in the “surroundings” of the exploit.

We have provided 2 new EPL and CE images with the “mitigation” (session.upload_progress.enabled=Off) for this. These also include the latest (Security-) fixes for EGroupware 26.

Please promptly deploy the images on your system as follows:

cd /etc/egroupware-docker
docker compose pull && docker compose up -d && docker logs -f egroupware
# Ctrl-C to exit once you see: NOTICE: fpm is running, pid 1

EGroupware 23.1
For Instances who, contrary to our recommendations, are still using EGroupware 23.1, we have also provided new images that include the “mitigation” and an additional security fix from EGroupware itself.

We would like to strongly recommend executing the mitigation, the PHP fix released this afternoon, AND the update to 26 as soon as possible!

As soon as the PHP security update is available, we will provide new images for EGroupware 26 and EGroupware 23.1. Please also install these promptly. We will send another email once the packages are ready.

If you have any questions regarding EGroupware, the security update, or the update to EGroupware 26, feel free to contact our team at any time!

Birgit and the EGroupware Team

[bbegw]

[bbegw]

2. customer information for the security vulnarability in PHP:

The potentially severe security vulnerabilities in PHP are now public with more details on possible attack vectors.
Since there are no new images that we can roll out to you via Docker yet, we have incorporated two additional mitigations in a new Docker image:

• session.upload_progress.enabled=Off
• memory_limit=-1 (has the disadvantage that unlimited resources of FPM can be used with this, therefore it will be removed as soon as the new PHP version is available)
• fatal_error_backtraces=0

Please promptly apply the images to your system as follows (also analogously for 23.1):
cd /etc/egroupware-docker
docker compose pull && docker compose up -d && docker logs -f egroupware
# Ctrl-C to exit once you see: NOTICE: fpm is running, pid 1

EGroupware 23.1
The newly built packages for 23.1 are created for goodwill reasons and because it is known that some customers still run 23.1. This is explicitly not to be considered an extension of support for 23.1!

As soon as new PHP images 8.5.12 are available, we will build packages again (with the PHP version also for 23.1), which will then be deployed to you via Watchtower tonight. If you have Watchtower disabled, it must be applied manually!

Updates on Univention / UCS:
Connect via ssh to the Univention installation and execute the following:

# 1. Log in to Docker at download.egroupware.org:
docker login download.egroupware.org
User: XXXX
Password: YYYYY
Attention: If you do not have credentials for the download server (EPL repo access with username and password), send us an email or call, and we will create the access for you!
 
# 2. Backup of docker-compose.yml
cp /var/lib/univention-appcenter/apps/egroupware/compose/docker-compose.yml{,.bak-$(date +%s)}
 
# 3. Patch in the EGroupware image: "egroupware/egroupware:26" or for EPL: "download.egroupware.org/egroupware/epl:26"
sed -i 's|image: "docker.software-univention.de/egroupware-egroupware:[^"]*"|image: "download.egroupware.org/egroupware/epl:26"|' \
  /var/lib/univention-appcenter/apps/egroupware/compose/docker-compose.yml
 
# 4. Recreate the EGroupware container with the EGroupware image:
cd /var/lib/univention-appcenter/apps/egroupware/compose
docker-compose pull && docker-compose -p egroupware up -d --no-deps egroupware

Afterwards you will be on the new 26.10.20261016.4 image, which contains the three mitigations and also the current EGroupware (security) fixes.
With the same procedure, but only step 4, you can then also apply the PHP security fix as soon as the packages/images for it are available.

We would like to strongly recommend executing the mitigations, the likely tomorrow-released PHP fix itself, AND the update to 26 as soon as possible!

[StefanU]

[StefanU]

[bbegw]

Update 27 October 2026: According to ENISA and CISA, the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been actively exploited since 26 October 2026. We are not aware of any case affecting EGroupware installations.

Cloud customers need to do nothing. Self-hosted users, please check under Admin → PHP information that PHP 8.5.12 or newer is running, and update immediately if not.

Full details in our customer information: https://pole.egroupware.org/egroupware/share.php/gr901bH3olxs8wtbCuHwB5fbYNHuan2o and https://www.egroupware.org/en/general/php2shell-and-our-strategy