PHP vulnerabilities: Passwork status and guidance

Warning: critical PHP vulnerabilities. CVE-2026-109618 and CVE-2026-109619 can allow an unauthenticated attacker to run code on a server that runs PHP, PHP-FPM included. Both score 9.2 on CVSS v4.0, and the PHP project says updating is the only complete fix. On-premise Passwork administrators should move PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Update from PHP: Fixes released

The PHP project announced a critical security release on 20 October and published it on 21 October. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both vulnerabilities. The advisory covers every PHP installation that serves web requests, PHP-FPM included, and states that "there are no complete mitigations, updating is the only safe choice."

CVE What goes wrong Reported impact
CVE-2026-109618 Out-of-memory handling can interrupt PHP while request data is only partly initialized, and request cleanup then treats that data as valid Unauthenticated remote code execution as the web worker account
CVE-2026-109619 Request state survives after its memory is freed, and a later request on the same worker uses it Unauthenticated remote code execution and memory disclosure

Self-hosted installations: update plan

Administrators of self-hosted installations must update the PHP-FPM that serves Passwork to the fixed release for their branch, restart it, and verify the version on the PHP-FPM binary rather than in a shell. Start with instances reachable from the internet.

Before you touch production:

  • Snapshot the database and configuration, and rehearse the restore on a spare host if you have not done so recently.
  • Take the fixed release of the branch you already run. Moving to a different branch is a separate change that needs its own test against your Passwork version.
  • Install builds only from your distribution, your vendor, or php.net. Source builds and Windows binaries are on the PHP downloads page, and distribution and long-term support vendors received the patches in advance, so look for their packages before compiling anything.

Then apply the update the way you installed PHP, through a package or a container image, restart the service, and confirm that the PHP-FPM serving Passwork reports a fixed version. The command-line PHP can report a different version than PHP-FPM, so check the one that handles web requests.

If you cannot update right away

Until the update is installed, narrow who can reach Passwork. Put it behind a VPN or limit it to an allow-listed network range, and list every client that connects from outside first: remote staff, mobile apps, browser extensions, API and CLI jobs. Each of them stops working if you restrict access without allowing it.

The PHP advisory also lists interim settings for each CVE, covering memory limits, request size limits, and session upload progress. They close individual attack paths and do not make an installation safe. Test them on a staging instance before production, because they change memory, upload, and session behavior.