tl;dr On 2026-10-22 we released fixed PHP packages for UCS 5.2, and for UCS 4.4 and UCS 5.0 as part of Extended Security Maintenance. Install the updates. On UCS 4.4, restart Apache afterwards.
UCS 4.4 and UCS 5.0 were affected, because Primary and Backup Directory Nodes run SimpleSAMLphp for Single Sign-On (SSO).
UCS 5.2 and later don’t use PHP in the base system.
Some apps are affected too. See the section on Apps.
The vulnerabilities
On 2026-10-21 the PHP project released security updates for two critical remote code execution vulnerabilities.
According to the PHP project all PHP installations serving web requests are at risks. See the PHP security advisory.
Status
On 2026-10-22 we released the following fixed packages. The updates for UCS 4.4 and UCS 5.0 are only available to customers with a extended security maintenance subscription.
| UCS release | PHP package | Fixed version |
|---|---|---|
| UCS 4.4-9 | php7.0 | 7.0.33-0+deb9u26 |
| UCS 5.0-10 | php7.3 | 7.3.31-1~deb10u16 |
| UCS 5.2 | php8.2 | 8.2.35-1~deb12u1 |
- UCS 4.4-9 fix for EMS in Erratum 1905
- UCS 5.0-10 fix for EMS in Erratum 1504
- UCS 5.2-x PHP Update to fixed version Problem: UCS 5.2 - Remediation of CVE-2026-109618 & CVE-2026-109619 (PHP2Shell Vulnerability)
Hint
On UCS 4.4, restart Apache after you install the update, so that it loads the updated PHP module:
systemctl restart apache2.
UCS 5.0 and UCS 5.2 don’t need a restart.
The php8.2 package in UCS 5.2 has unmaintained status, so its update doesn’t show up on the errata page.
UCS 4.4 and UCS 5.0
Reduce exposure
The PHP project lists the following configuration changes to reduce exposure to this specific attack path. They do not fix the vulnerabilities. The provided config snippets are temporary workarounds until the fixed version is released. We still recommend restricting access to the SSO service.
To apply the workarounds create the following file on all Primary and Backup Directory Nodes:
- UCS 4.4:
/etc/php/7.0/cgi/conf.d/99-php2shell.ini - UCS 5.0:
/etc/php/7.3/cgi/conf.d/99-php2shell.ini
memory_limit = -1
session.upload_progress.enabled = 0
The changes take effect with the next request.
Restrict access to the SSO service
On UCS 4.4 and UCS 5.0, SimpleSAMLphp for SSO is installed on Primary and Backup Directory Nodes. Until you install the fixed packages or update to UCS 5.2, we recommend exposing the SSO service only to trusted internal networks.
The SSO service is the virtual host ucs-sso.<your-domain> on ports 80 and 443 of these nodes. To check the name in your domain, run ucr get ucs/server/sso/fqdn. Restrict access on your firewall or reverse proxy. While the restriction is in place, users outside the trusted networks can’t sign in through SSO, including to connected services.
To check whether the service is reachable from a network, run:
curl -sk -o /dev/null -w '%{http_code}\n' \
--resolve <sso-host-name>:443:<ip-of-node> \
https://<sso-host-name>/simplesamlphp/
302 means it’s reachable.
On UCS 4.4, Apache also loads the PHP module mod_php, the setup with a demonstrated exploit. By default, it serves no PHP files. If you serve your own PHP files through Apache on these nodes, restrict access to them as well.
UCS 5.2
UCS 5.2 and later use Keycloak for SSO. The base system doesn’t use PHP. In our tests, the upgrade from UCS 5.0 removed SimpleSAMLphp and PHP. If you installed PHP for other purposes, it might still be present. The PHP packages in UCS 5.2 have unmaintained status. We released php8.2 8.2.35-1~deb12u1 on 2026-10-22.
Apps
Some apps from the App Center ship their own PHP in their Docker images. They receive updates from the app vendors, not through UCS errata. The following apps use an affected PHP version in their current release:
| App | App version | PHP in the image | Status |
|---|---|---|---|
| Nextcloud | 32.0.13-0 | 8.3.6 | fixed in 33.0.10-0, available for UCS 5.2 only. UCS 5.0 is still affected |
| EGroupware | 26.10.20261016 | 8.5.11, push container 8.4.25 | fixed in 26.10.20261021 |
| Benno MailArchiv | 2.10.3 | 8.2.7 | waiting for vendor update |
Update these apps as soon as the vendor releases a new version. Until then, restrict access to the apps to trusted networks if possible.
Discontinued app versions on UCS 4.4 and UCS 5.0
Extended maintenance for UCS 4.4 and UCS 5.0 doesn’t cover apps. The following app versions are discontinued and won’t receive any updates. They ship PHP versions for which the PHP project provides no fixes, and they’re likely affected by further security vulnerabilities.
| App | App version | UCS | PHP in the image |
|---|---|---|---|
| Nextcloud | 24.0.11-0 | 4.4 | 7.4 |
| EGroupware | 23.1 | 4.4 | 8.1 |
| Benno MailArchiv | 2.10.2 | 4.4 | 7.4 |
| HumHub | 1.9.0 | 4.4, 5.0 | 7.4 |
| Brainyoo | 20230302 | 4.4, 5.0 | 7.3 |
| ownCloud | 10.12.1, 10.13.4 | 4.4, 5.0 | 7.4 |
| BlueSpice | 3.2.6, 3.2.7 | 4.4, 5.0 | 7.3, 7.4 |
| WordPress | 5.2.3 | 4.4, 5.0 | 7.3 |
Updates
- 2026-10-21: Initial posting.
- 2026-10-22: Released fixed packages for UCS 4.4, UCS 5.0 and UCS 5.2.
- 2026-10-22: Add section on Apps