Re: [Emc-developers] Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619

[John T. <jt...@gn...>]

Got a pm from Stephen

we can't upgrade php easily on the vps that we're using - I've been 
thinking of alternatives over the past few days anyway, but i don't have 
a solid plan yet. I'll take steps to mitigate the vulnerability tonight 
(if i get home in time) or tomorrow (and I'll be gone until late in the 
day tomorrow)

JT

On 10/22/26 04:35, andy pugh wrote:
> The forum runs Joomla and Kunena, which are PHP apps, so very much affected.
>
> Digital Ocean report that:
>
> "patches are only available for currently supported PHP versions (8.2
> and later). If you are running an end-of-life PHP version (8.1 or
> earlier), no official patch will be available and you should plan an
> immediate upgrade to a supported version."
>
> Looking at the forum admin panel:
>
> "We have detected that your server is using PHP 7.4.3-4ubuntu2.29
> which is obsolete and no longer receives official security updates by
> its developers. Furthermore, we cannot recommend a newer PHP version
> because you are using an outdated Joomla! version. We recommend
> updating Joomla! and then following further PHP upgrade instructions."
>
> It looks like we need to make a major upgrade.
>
> Do any of us know _how_ to upgrade the forum server? I think that JT might?
>