XF 2.3 PHP Emergency Patches & XenForo Cloud Status (CVE-2026-109618 / CVE-2026-109619)

jtb33

jtb33

Member
Licensed customer
arstechnica.com

PHP warns it plans to release 2 emergency patches imminently

Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
arstechnica.com arstechnica.com

Hi XenForo Team and Community,

With the recent news regarding the upcoming critical emergency patches for PHP (CVE-2026-109618 and CVE-2026-109619) dropping imminently, I wanted to check in regarding the status for those of us who are XenForo Cloud customers.

Since the vulnerabilities are rated 9.2/10 and mass exploits are expected quickly following the 14:00 UTC release window, could the team clarify the patching window and deployment plan for the Cloud infrastructure?

Are these patches being rolled out automatically to all XenForo Cloud instances immediately upon release, and should we anticipate any brief downtime or maintenance windows when the underlying PHP environment is updated?

Thanks in advance for the update and for keeping our communities secure!
 
Sort by date Sort by votes
xml said:
XenForo 2.2.12
Click to expand...
XenForo

Thread 'XenForo 2.2.12 and Add-On Updates Released'

XenForo 2.2.12 Released​

XenForo 2.2.12 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability.

We're pleased to announce the introduction of two new features available in XenForo 2.2.12.

New CAPTCHA provider: Cloudflare Turnstile​

In September, Cloudflare Turnstile was announced. You may have noticed that we quickly implemented this into the software and it has been running here now for a little while.

While on the surface this...
  • Like

You should update your php to the absolute latest version of the php you have ... ASAP.
 
Upvote 0 Downvote
Digital Doctor said:
XenForo

Thread 'XenForo 2.2.12 and Add-On Updates Released'

XenForo 2.2.12 Released​

XenForo 2.2.12 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability.

We're pleased to announce the introduction of two new features available in XenForo 2.2.12.

New CAPTCHA provider: Cloudflare Turnstile​

In September, Cloudflare Turnstile was announced. You may have noticed that we quickly implemented this into the software and it has been running here now for a little while.

While on the surface this...
  • Like

You should update your php to the absolute latest version of the php you have ... ASAP.
Click to expand...

I am on 8.2.35 the latest version. I am just asking if php8.3 is compatible with xf2.2.12
 
Upvote 0 Downvote
Andy.N said:
Time to move. A host worth your money would be all over this issue.
Click to expand...

smallwheels said:
updating a compelete hosting environment with tens of thousands of customers is a little bit more complex than updating a single VPS. The patch has now been available for just 2 hours - a bit weird to start complaining already und to suggest searching for a new hoster....
Click to expand...
My site has in the meantime been updated to 8.3.36 by the hosting company, less than four hours after the patch was released. To advise I should go for a new hoster was and is ridiculous.
 
Upvote 0 Downvote
smallwheels said:
My site has in the meantime been updated to 8.3.36 by the hosting company, less than four hours after the patch was released. To advise I should go for a new hoster was and is ridiculous.
Click to expand...
I'm glad that it works out great. My comment was to say if the hosts are not on top of these issues, it's in everyone's best interest in finding another host.
 
Upvote 0 Downvote
smallwheels said:
My site has in the meantime been updated to 8.3.36 by the hosting company, less than four hours after the patch was released. To advise I should go for a new hoster was and is ridiculous.
Click to expand...
I appreciate there are matters of scale, but four hours given the severity of this is too much IMO.

Would you have been as accommodating if within an hour your site had been defaced or worse? Our own rollout wasn't as quick as I'd have liked but that was still done within approximately 30 minutes.

The main issue there was Remi's repo not being updated so we had to rebuild PHP from source, essentially. We'd have probably had it done within 5-10 minutes otherwise.
 
Upvote 1 Downvote
Chris D said:
I appreciate there are matters of scale, but four hours given the severity of this is too much IMO.

Would you have been as accommodating if within an hour your site had been defaced or worse? Our own rollout wasn't as quick as I'd have liked but that was still done within approximately 30 minutes.

The main issue there was Remi's repo not being updated so we had to rebuild PHP from source, essentially. We'd have probably had it done within 5-10 minutes otherwise.
Click to expand...
Still waiting on Nimbus... :-(

If it helps anyone, if your host has done the temporary mitigation stuff to disable the multipart form submsision, disabling javascript at least lets you login to admin panel, make a post, add a notice, etc so you can let your users know what's happening.
 
Upvote 0 Downvote
Chris D said:
I appreciate there are matters of scale, but four hours given the severity of this is too much IMO.
Click to expand...
Obviously I had liked it if it was quicker, but as they migitated the risk by limiting PHP massively in the morning already I found it kind of tolerable and I absolutely trust them in what they are doing.
Chris D said:
The main issue there was Remi's repo not being updated so we had to rebuild PHP from source, essentially. We'd have probably had it done within 5-10 minutes otherwise.
Click to expand...
I updated a VPS running Centmin Mod myself in the meantime and wasn't much faster, as I managed to shoot myself in the foot brilliantly while dealing with some issues. But as I had shut down nginx on the VPS already in the morning it wasn't time critical. ;)
 
Upvote -1 Downvote
Is XenForo 2.3.4 compatible with PHP 8.2.35? I tried looking around but was unable to locate a guide on which versions of XF are compatible with which versions of PHP. Any help appreciated.
 
Upvote 0 Downvote
cwe said:
Is XenForo 2.3.4 compatible with PHP 8.2.35? I tried looking around but was unable to locate a guide on which versions of XF are compatible with which versions of PHP. Any help appreciated.
Click to expand...
Yes. Most PHP versions up to 8.5 are compatible with XF 2.3.

Suzanne O said:
Php 8.3.35 is mine and no issues yet.
Click to expand...
You need to update it to PHP 8.3.36. This is not an issue you want to wait for. The PHP update is required or your forum is likely entirely vulnerable.
 
Upvote 2 Downvote
Here are the fixed versions for those of us using Ubuntu's backports

PHP version starts with 8.5?
  • Full version exactly matches 8.5.4-0ubuntu1.5? Fixed
  • Version equal to or greater than 8.5.12? Fixed
  • Otherwise, not fixed.

PHP version starts with 8.4?
  • Version equal to or greater than 8.4.27? Fixed
  • Otherwise, not fixed.

PHP version starts with 8.3?
  • Full version exactly matches 8.3.6-0ubuntu0.24.04.13? Fixed
  • Version equal to or greater than 8.3.36? Fixed
  • Otherwise, not fixed.

PHP version starts with 8.1?
  • Full version exactly matches 8.1.2-1ubuntu2.28? Fixed
  • Otherwise, not fixed.
Click to expand...
 
Upvote 0 Downvote
I just got one update saying they had patched package and were applying it across the fleet. But shortly followed by another one saying

"Identified

Information regarding package availability for patched PHP versions was miscommunication to us by upstream, and we are still awaiting their release. In the meantime, we have applied all available mitigations across the fleet, and continue to monitor.

We will keep you updated. Thank you for your patience.
Wed, Oct 21, 2026, 11:10 PM"

I've applied a Cloudflare Maintenance snippet 503 rather than a block, to keep the site offline. Hope it doesn't take too long.
 
Upvote 0 Downvote
I expect my host (namecheap) will fix this once they're up and about their time. (They're over in the USA) They've been contacted with the link to your announcement on this.
 
Upvote 0 Downvote
You must log in or register to reply here.
Back
Top Bottom