PHP Critical Vulnerability Fix Announcemen

[RyanYang]

The PHP project has officially disclosed two critical vulnerabilities, CVE-2026-109618 and
CVE-2026-109619. The first may corrupt runtime state during out-of-memory (OOM)
exception handling; the second involves global state that is not properly reset between
requests and may reference freed memory. Both can be triggered by unauthenticated
requests and may lead to remote code execution.

Affected scope
1. TOS 5 / TOS 6 systems;
2. TOS 7 systems with PHP installed, or with applications that depend on PHP;
3. Containers in Container Manager that run PHP images or self-built PHP applications.
TOS 7 systems without PHP installed are not affected. The server-side PHP components used
by system functions have been fully patched.

Potentially affected applications
Some applications prompt you to install PHP during installation and will install it
automatically after you confirm. Open TOS 7 App Center and go to Installed to check whether PHP is installed.
If any of the following PHP-dependent applications are installed, update PHP as well. Please
check all of them:
Web Server, FreshRSS, Joomla!, MantisBT, MyBB, Net2FTP, MyWebSQL, Nextcloud, e107_cms,
elFinder, phpBB, phpMyAdmin, WordPress, ZenTao, VirtualBox, MariaDB, Xunlei, qBittorrent,
Tailscale, Oray Pgyer.

TOS fixed versions
PHP 7.4: 7.4.33.14 (x86 / ARM)
PHP 8.0: 8.0.30.3 (x86), 8.0.30.2 (ARM)

How to update
1. TOS 7 users: Open App Center, go to PHP, and update PHP 7.4 / 8.0. After the update,
restart the applications or services that use PHP (such as Web Server), then check that
your website works properly. If a site is configured to use a specific PHP version, switch it
to the new version.
2. TOS 5 / 6 users: Please update to TOS 7.
3. Container Manager users: PHP inside a container is independent of the system PHP.
Update the PHP image and recreate the container. If you cannot update it right away,
restrict public access to the container for now.
4. Other community applications: Check whether PHP is installed. Update the application
first; if you cannot update it right away, restrict its public access.
If App Center does not show the update, click Refresh in App Center.

[apvm]

Before this announcement, I tried php 7.4 for tailscale last week but uninstalled php 7.4 and don't need it, will it affect me or i have to reinstall php 7.4? Thanks.

[JettNing]

Before this announcement, I tried php 7.4 for tailscale last week but uninstalled php 7.4 and don't need it, will it affect me or i have to reinstall php 7.4? Thanks.

Hello apvm,

Regarding your question: Yes, uninstalling PHP 7.4 will directly cause Tailscale to malfunction and result in a 502 error when accessing the web interface.

Tailscale's web interface relies on PHP for parsing. Therefore, if you still need to use Tailscale, you will need to reinstall PHP 7.4.

However, since this is a critical vulnerability fix announcement, please make sure to install the latest patched version of PHP 7.4 to ensure your system's security.