XF 2.3 PHP Emergency Patches & XenForo Cloud Status (CVE-2026-109618 / CVE-2026-109619)

jtb33

jtb33

Member
Licensed customer
arstechnica.com

PHP warns it plans to release 2 emergency patches imminently

Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
arstechnica.com arstechnica.com

Hi XenForo Team and Community,

With the recent news regarding the upcoming critical emergency patches for PHP (CVE-2026-109618 and CVE-2026-109619) dropping imminently, I wanted to check in regarding the status for those of us who are XenForo Cloud customers.

Since the vulnerabilities are rated 9.2/10 and mass exploits are expected quickly following the 14:00 UTC release window, could the team clarify the patching window and deployment plan for the Cloud infrastructure?

Are these patches being rolled out automatically to all XenForo Cloud instances immediately upon release, and should we anticipate any brief downtime or maintenance windows when the underlying PHP environment is updated?

Thanks in advance for the update and for keeping our communities secure!
 
Sort by date Sort by votes
PHP 8.2 security support ends on 31 December 2026, so I need official confirmation of whether PHP 8.3 is compatible with XenForo 2.2.12. I’m not planning to upgrade XenForo to a higher version. Activity and visitor numbers have dropped over the past few years, so it isn’t financially worthwhile for me.
 
Upvote 0 Downvote
This is the latest from Nimbus:

This patch is to address vulnerabilities reported in CVE-2026-109618 and CVE-2026-10961 -- and covers these version:
v81: ea-php8.1.34-5
v82: ea-php82 8.2.35
For more detailed information, you may also check this page: https://support.cpanel.net/hc/en-us...y-Release-CVE-2026-109618-and-CVE-2026-109619

Could I just sense-check that? I'm currerntly on 8.1 and they're saying 8.1 will be patched, right?
 
Upvote 0 Downvote
xml said:
PHP 8.2 security support ends on 31 December 2026, so I need official confirmation of whether PHP 8.3 is compatible with XenForo 2.2.12. I’m not planning to upgrade XenForo to a higher version. Activity and visitor numbers have dropped over the past few years, so it isn’t financially worthwhile for me.
Click to expand...
We're looking at 2.2.12 PL2 on a test bench right now with PHP 8.3.36, it basically seems to install/run fine. It seems like the most glaring issue is around template warnings that don't get filtered out. This doesn't count any addons or customized content, just bone stock XF.

XenForo templates routinely read optional values that may not be set, such as {$head.meta_site_name}. PHP 8 reports that as a warning, and 2.2.12 deliberately ignores it by matching the warning's text. PHP 8.3 changed that text, so the match fails and each one is logged as a "Template error".

Basically, you log fills up with garbage. And additionally, it appears that email rendering may generate a warning in the log as well.
 
Last edited:
Upvote 0 Downvote
ENF said:
We're looking at 2.2.12 PL2 on a test bench right now with PHP 8.3.36, it basically seems to install/run fine. It seems like the most glaring issue is around template warnings that don't get filtered out. This doesn't count any addons or customized content, just bone stock XF.

XenForo templates routinely read optional values that may not be set, such as {$head.meta_site_name}. PHP 8 reports that as a warning, and 2.2.12 deliberately ignores it by matching the warning's text. PHP 8.3 changed that text, so the match fails and each one is logged as a "Template error".

Basically, you log fills up with garbage. And additionally, it appears that email rendering may generate a warning in the log as well.
Click to expand...

Thanks for testing this. Would PaulB’s PHP 8.3 compatibility patch fix these issues? It covers the template warning text check and the “increment on bool” warning in the BbCode HTML renderer. I suspect the email warning is the second one.


https://xenforo.com/community/threads/php-8-3-compatibility-patch.217923/
 
Upvote 0 Downvote
  • Like
Reactions: xml
Upvote 0 Downvote
RobParker said:
This is the latest from Nimbus:

This patch is to address vulnerabilities reported in CVE-2026-109618 and CVE-2026-10961 -- and covers these version:
v81: ea-php8.1.34-5
v82: ea-php82 8.2.35
For more detailed information, you may also check this page: https://support.cpanel.net/hc/en-us...y-Release-CVE-2026-109618-and-CVE-2026-109619

Could I just sense-check that? I'm currerntly on 8.1 and they're saying 8.1 will be patched, right?
Click to expand...
RobParker said:
Yeah they haven’t. Very poor/confused communication from their support team.
Click to expand...
From the updates page from my server, it seemed they were having to wait on "partners" (cloud linux/cpanel) to test and make things available and then (I think) a bottleneck with all servers trying to access the patches at the same time. Mine has just been backported overnight. The alt-php ones were done last.
zappaDPJ said:
8.2.35 is the oldest version to be officially patched but your provider may have implemented a backported fix. You would need to contact them to find out.
Click to expand...
As @zappaDPJ says - probably best to open a support ticket and ask them directly.
 
Upvote 0 Downvote
cdub said:
What is this PHP issue in layman's terms?
Click to expand...
The recent issues allowed unauthenticated remote code execution on PHP installations serving web requests:

CVE-2026-109618 - remote code execution through out-of-memory state corruption.
CVE-2026-109619 - remote code execution through stale global state reused across requests.
 
Upvote 0 Downvote
Upvote 0 Downvote
You must log in or register to reply here.
Back
Top Bottom