[Astlinux-users] php, security fixes: CVE-2026-109618, CVE-2026-109619 (php2shell)

[Lonnie A. <li...@lo...>]

Announcing AstLinux Pre-Release astlinux-1.5-6768-82a946

More Info: AstLinux Project -> Development
https://www.astlinux-project.org/dev.html

This Pre-Release contains a fix for CVE-2026-109618, CVE-2026-109619 (php2shell)

Any testing in a lab environment would be greatly appreciated.

Note: PHP 'session.upload_progress.enabled' is now 'Off' regardless of php.ini setting

We have tested in the lab several POC exploits, and so far they fail (no exploit), both before the security patch is applied and with the security patch.  So that is good news.  Not to say that a specially crafted exploit could affect pre-patched systems.

Be on the lookout for any web interface issues caused by the security patch.

This is good reminder that exposing the web interface to the internet without a restrictive firewall or VPN is bad practice.

Pre-Release ChangeLog:
https://beta-astlinux-project.us-southeast-1.linodeobjects.com/astlinux-changelog/ChangeLog.txt

AstLinux Project