Univention Help

PHP2Shell Vulnerability

UCS - Univention Corporate Server

boospy October 22, 2026, 11:56am 13

github.com/nextcloud/univention-app

Provide new containers for php2shell vulnerabilities

offen 10:18AM - 21 Oct 26 UTC

PHP will disclose two vulnerabilities today which allow arbitrary command execut…ion: https://www.php.net/archive/2026.php#2026-10-20-1 New AppCenter containers should be provided as soon as possible.

PHP remote code execution vulnerabilities in UCS CVE-2026-109618 and CVE-2026-109619 (php2shell) Supported

tl;dr On 2026-10-22 we released fixed PHP packages for UCS 5.2, and for UCS 4.4 and UCS 5.0 as part of Extended Security Maintenance. Install the updates. On UCS 4.4, restart Apache afterwards. UCS 4.4 and UCS 5.0 were affected, because Primary and Backup Directory Nodes run SimpleSAMLphp for Single Sign-On (SSO). UCS 5.2 and later don’t use PHP in the base system. Some apps are affected too. See the section on Apps. The vulnerabilities On 2026-10-21 the PHP project released security updates…

1 Like

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled

© Univention GmbH

Product Documentation
Contact
Terms of use
Imprint
Privacy

Mastodon