PHP emergency security releases — Oct 2026

On 21 October 2026 the PHP project released emergency security updates for two critical remote code execution vulnerabilities (both CVSS v4.0 9.2):

• CVE-2026-109618 — RCE via out-of-memory (OOM) corruption (GHSA-w8hw-w9fx-j79w)
• CVE-2026-109619 — RCE via stale global state (GHSA-6wmf-4rv5-p3rp)

These are bugs in PHP itself, not in Externa, but every Externa install runs on PHP, so please update.

This notice mirrors the GitHub announcement. Requirements live at docs.externa.qiick.io.

Affected and fixed versions

Externa requires PHP 8.4+ (^8.4), so you need PHP 8.4.27 or 8.5.12 or later.

What to do

• Herd / bare metal: update PHP to 8.4.27 (or 8.5.12), then restart PHP-FPM, Horizon, Reverb and the scheduler. Check with php -v.
• Official Docker image (ghcr.io/qiick-io/externa-core): The 1.2.1 image (and latest) has been rebuilt on PHP 8.4.27. Pull ghcr.io/qiick-io/externa-core:1.2.1 again and recreate the containers (docker compose pull && docker compose up -d), then check with docker compose exec <php-service> php -v.
• Building from source with the Dockerfile: rebuild with --pull --no-cache so you pick up the updated php:8.4-fpm-bookworm base (PHP 8.4.27).

If you can't update right away

Updating PHP is the only complete fix. The PHP advisories list these partial mitigations:

• Set memory_limit=-1 in the server-level PHP config (php.ini / FPM pool, not per-directory), restart every worker, and rely on a container or cgroup memory limit instead. Do not use RLIMIT_AS/RLIMIT_DATA.
• Keep post_max_size conservative, enforce request size at your reverse proxy, and limit multipart parts, headers per part, uploads and max_input_nesting_level. If you don't need multipart uploads on a route, block them at the proxy.
• Set session.upload_progress.enabled=0 and restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
• Optionally, pm.max_requests=1 in PHP-FPM if performance allows.

Note: Externa's file uploads use multipart requests, so blocking multipart entirely will break uploads in the admin.

Coming in Externa 1.2.2

Externa 1.2.2 will ship additional php.ini hardening for the official image (#216).

Sources

• GitHub announcement (discussion #247)
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• Externa docs