XF 2.3 PHP Emergency Patches & XenForo Cloud Status (CVE-2026-109618 / CVE-2026-109619)

jtb33

jtb33

Member
Licensed customer
arstechnica.com

PHP warns it plans to release 2 emergency patches imminently

Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
arstechnica.com arstechnica.com

Hi XenForo Team and Community,

With the recent news regarding the upcoming critical emergency patches for PHP (CVE-2026-109618 and CVE-2026-109619) dropping imminently, I wanted to check in regarding the status for those of us who are XenForo Cloud customers.

Since the vulnerabilities are rated 9.2/10 and mass exploits are expected quickly following the 14:00 UTC release window, could the team clarify the patching window and deployment plan for the Cloud infrastructure?

Are these patches being rolled out automatically to all XenForo Cloud instances immediately upon release, and should we anticipate any brief downtime or maintenance windows when the underlying PHP environment is updated?

Thanks in advance for the update and for keeping our communities secure!
 
Sort by date Sort by votes
Cloudflare automatically deployed a temporary rule as they’ve seen attacks already. But the patch comes available from PHP in two hours and they will definitely need to be applied. I think we can expect a brief downtime, but nothing serious or long. Patches are usually quickly applied and a server reboot is done in 5 minutes.
 
Upvote 0 Downvote
Hey all,

My host has recommended I shut all sites that are not essential to operations, and then email all forums users with an update (that's done) and even close the main forums that make money for at least 24 hours while the world works out what the heck this exploit can do, and what damage can be done, and what measures need to be taken to avoid it effecting us.

In the meantime we are all waiting for a security patch for PHP 8.2 and above.

Apparently anything below php 8.2 wont be patched, so make sure all your sites are at least on 8.2 (8.3.x is out I think, my sites are on that).

Servers running plesk and cpanel will probably get auto patched if that setting is on, if not, turn it on. But the patch wont be available for a couple of days!!!!!! - And when they do roll it out it'll be global - so slow?

What mitigations have people made in the meantime to help with this?

Would 'under attack mode' be worth using in CF?

Or once one bypasses that, could the zero-day still be used?

Any clues?
 
Upvote 0 Downvote
XenForo

Thread '🚨 URGENT: Update your PHP immediately'

A critical security issue has been discovered affecting PHP versions dating back to PHP 5.4. These vulnerabilities can allow attackers to execute arbitrary commands on affected servers without authentication.

If you are running an unpatched version of PHP, you must upgrade immediately. If you are running PHP 8.1 or earlier, you should move to a supported, patched version. The minimum officially supported PHP version containing these fixes is PHP 8.2.35. PHP 8.3.36, 8.4.27 and 8.5.12 are also patched.

Please see the official PHP security advisory for more...
  • Like
  • Love
  • Haha
 
Upvote 0 Downvote
You must log in or register to reply here.
Back
Top Bottom