Skip to content

Upstream Security Advisory · 22 October 2026

PHP Security Vulnerabilities — Already Patched in Saphira Linux

Two serious upstream PHP runtime vulnerabilities have fixes available in Saphira's PHP 8.5 package. Update normally, reload a running PHP service, and carry on.

Saphira Linux dragon mascot

What Saphira PHP 8.5 users should do

Affected component
Upstream PHP runtime
Verified package
php85-8.5.12-r1 in the current Hatched repository; the published APK signature validates against Saphira's repository key.
Fixed status
Fixed for the Saphira-packaged PHP 8.5 runtime.
Service activation
Restart PHP-FPM if it is running, so workers load the corrected runtime.
apk update
apk upgrade

# OpenRC, if PHP-FPM is in use
rc-service php-fpm restart

# Saphira-D, if PHP-FPM is in use
systemctl restart php-fpm85

apk update refreshes repository metadata and apk upgradeinstalls available upgrades. A restart is only needed for a PHP service that is already running; use the command that matches your init system.

What these vulnerabilities are

CVE-2026-109618 is an out-of-memory error-handling problem. PHP can be interrupted while request data is only partly set up, after which cleanup can treat invalid data as valid and corrupt memory.

CVE-2026-109619 is a use-after-free problem. Request-owned internal or global state can survive after its backing memory has been freed, allowing a later request handled by the same worker to use stale data.

Under vulnerable conditions, these flaws can permit unauthenticated remote code execution with the privileges of the web worker or server process. The official CVSS v4.0 score is 9.2 (Critical), not 10.0. Apache mod_php is the highest-risk deployment, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected upstream.

Scope and fixed versions

These are not defects originating in Saphira Linux. They are upstream PHP runtime vulnerabilities. Running PHP does not mean a website has been compromised; it does mean that maintaining the runtime matters.

  • PHP 8.2.35
  • PHP 8.3.36
  • PHP 8.4.27
  • PHP 8.5.12 — verified as Saphira's signed php85-8.5.12-r1 package

PHP 8.1 and older are unsupported upstream. Custom PHP builds, containers and externally managed installations are outside the verified Saphira package path and need checking separately.

Authoritative references

Need help maintaining or modernising PHP?

AKADATA LIMITED provides PHP maintenance, security updates, code reviews, performance improvements and application modernisation. Contact us if your infrastructure or application needs engineering assistance.

This is an optional commercial service, not a requirement for using Saphira Linux. Contact AKADATA LIMITED support →