PHP Vulnerabilities
On October 21, 2026, two critical vulnerabilities affecting PHP were disclosed: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities could allow remote code execution on a server without prior authentication.
Deployments of the following software are affected by this security alert:
- Flexisip Account Manager (FAM)
- LIME Server
- File Transfer Server
These vulnerabilities affect PHP versions prior to the available security fixes, including branches 7.x, 8.0, 8.1, and 8.2 through 8.5.
What action should you take?
If you use any of these software products, we encourage you to assess your environment and plan this update as soon as possible.
💡 For more information about these vulnerabilities and the recommended corrective measures, consult the alert published by the CERT-UE and by the CSIRTs Network.
