.svg)
|
Vulnerability Type |
Remote code execution (RCE) in PHP core |
|
Severity factors |
This is a critical vulnerability. The PHP security team has rated both vulnerabilities CVSS v4.0 9.2 (Critical). The vulnerabilities can allow an unauthenticated remote attacker to execute code on the server. |
|
Versions affected |
FileCloud versions earlier than 23.263.2 |
|
Version fixed |
FileCloud 23.263.2, which includes PHP 8.4.27 |
Description
On 21 October 2026, the PHP security team released PHP 8.4.27 to fix two critical vulnerabilities that may allow unauthenticated remote code execution:
-
CVE-2026-109618 (RCE via out-of-memory corruption): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
-
CVE-2026-109619 (RCE via stale global state): request-owned internal state can survive after its memory has been freed. A later request handled by the same worker may use that stale state before it is reset.
According to the PHP security team, all PHP installations serving web requests are at risk, including Apache with mod_php and PHP-FPM. The risk is considered highest for Apache with mod_php, where an unauthenticated request can trigger the attack before any application code runs.
FileCloud Server runs on PHP and is affected. FileCloud 23.263.2 includes the patched PHP version (8.4.27).
Fix
-
FileCloud Server on Windows and Linux: Upgrade to FileCloud 23.263.2 as soon as possible. This is the only remediation; there is no workaround or interim mitigation. Customers running any older FileCloud version should also upgrade to FileCloud 23.263.2.
-
FileCloud Online: FileCloud will apply the fix to all FileCloud Online environments. No customer action is required.
References
If you have any questions about this advisory, please contact FileCloud support.