Critical PHP vulnerabilities (CVSS 9.2)

On October 21, the PHP security team released fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. The Passbolt API runs on PHP, so every Passbolt server is concerned. Passbolt Cloud was taken offline as a precaution and is being restored as the patch is deployed. Self-hosted administrators must update PHP and restart their PHP services.

Summary

Both vulnerabilities are rated CVSS v4.0 9.2 (Critical) by the PHP security team. Until the release, PHP had only disclosed their severity: the affected versions, the nature of the flaws and any technical details were withheld until the patch was available. That information was published with the fix on October 21 at 15:40 CEST, in PHP’s security advisory.

The advisory confirms two remote code execution vulnerabilities: CVE-2026-109618 (via out-of-memory corruption) and CVE-2026-109619 (via stale state in PHP workers). The attack requires no authentication and can be triggered before any application code runs. Passbolt’s own security controls cannot block it: only an updated PHP does. PHP considers every installation serving web requests at risk, including PHP-FPM and Apache with mod_php.

Impact

Passbolt Cloud was taken offline at 14:30 CEST until 17:25 CEST, in line with CERT-EU’s recommendation to isolate internet-facing applications until a fix is available. Before that, it remained online with mitigations in place. We had reviewed our systems and logs for any sign of compromise. So far, we have found no trace of exploitation. We will publish the outcome of this review on this page if any.

Self-hosted instances reachable from the internet were exposed until PHP was patched on the server.

Affected versions

All Passbolt versions running on an unpatched PHP. Every PHP version before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 is affected, including versions that are no longer supported.

Fixed versions

Status per asset:

Passbolt Cloud: fixed.
Docker images: fixed.
AWS AMI: fixed.
OVA: fixed.
DigitalOcean: fixed, awaiting marketplace review.
Helm chart: update in progress. In the meantime, you can point your deployment to the latest patched Docker image.
Distribution packages (Debian, Ubuntu, RHEL…): PHP is provided by your OS, the fix comes through your distribution’s security updates.

What you can do now

Passbolt Cloud users: no action needed.

Self-hosted users:

Docker: pull the latest image and redeploy.
Existing OVA, AMI and DigitalOcean instances: a new image only helps new deployments, so update PHP through your system’s package manager.
Package install, update PHP, then restart PHP-FPM or your web server. The fix only takes effect once the running PHP processes are restarted.
No patched package for your system yet: keep your instance offline or unreachable from the internet until one is available. PHP’s advisory lists interim measures, but they do not make an installation safe.

Timeline

20/10: PHP announces a critical security release for 21/10 at 16:00 CEST. CERT-EU publishes Security Advisory 2026-018.
21/10, morning: Passbolt’s team starts monitoring the situation and applying mitigations.
21/10, during the day: Nextcloud, Dutch government services (MijnOverheid), Finland’s state IT centre and many others take PHP services offline as a precaution.
21/10 @ 14:30 CEST: Passbolt Cloud is taken offline as a precaution.
21/10 @ 15:40 CEST: PHP security release.
21/10 @ 16:00 CEST: The team is updating Passbolt Cloud and the self-hosted images (Docker, OVA, DigitalOcean). Passbolt Cloud will be restored once the update is deployed and verified.
21/10 @ 16:30 CEST: Linux distributions are publishing patched PHP packages. Self-hosted administrators using Passbolt’s distribution packages can update PHP on their servers. The fixed versions are listed on php.net.
21/10 @ 17:00 CEST: Patched Docker images, AWS AMI and OVA are published.
21/10 @ 17:25 CEST: Cloud is patched.