Ubuntu USN-8948-1 and USN-8948-2 Fix Critical PHP RCE Flaws
Tech GuruQuick Answer
Ubuntu published USN-8948-1 and USN-8948-2 for CVE-2026-109618 and CVE-2026-109619. Match each system to its Ubuntu release, install the listed PHP packages, rebuild images, restart every worker, verify the running version, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Ubuntu PHP releases, package families, SAPIs, worker pools, images, applications, exposure, owners, and entitlements; install the exact USN package; rebuild derived artifacts; restart all workers; validate request handling and logs; and retain evidence.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PHP packages on supported Ubuntu releases from 14.04 ESM through 26.10 |
|---|---|
| Advisory | USN-8948-1 / USN-8948-2 / GHSA-w8hw-w9fx-j79w / GHSA-6wmf-4rv5-p3rp |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Initial Ubuntu notice release time | 2026-10-21 13:56:19 UTC |
| Follow-on Ubuntu notice release time | 2026-10-21 15:33:58 UTC |
| Affected versions | Ubuntu 26.10, 26.04, 24.04, 22.04, 20.04 ESM, 18.04 ESM, 16.04 ESM, and 14.04 ESM with vulnerable PHP packages listed in USN-8948-1 or USN-8948-2. |
| Fixed version | 26.10: 8.5.9-0ubuntu2.1; 26.04: 8.5.4-0ubuntu1.5; 24.04: 8.3.6-0ubuntu0.24.04.13; 22.04: 8.1.2-1ubuntu2.28; 20.04: 7.4.3-4ubuntu2.29+esm5; 18.04: 7.2.24-0ubuntu0.18.04.17+esm14; 16.04: 7.0.33-0ubuntu0.16.04.16+esm22; 14.04: 5.5.9+dfsg-1ubuntu4.29+esm18 |
| CVSS base score | 9.2 (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | Ubuntu and the PHP project do not state that these vulnerabilities are being maliciously exploited in the wild.; no exploitation claim is inferred. |
What Changed
Ubuntu issued two related notices for PHP request-memory and stale-global-state flaws that can let a remote attacker execute arbitrary code. USN-8948-1 covers 22.04 through 26.10; USN-8948-2 extends fixed packages to 14.04 through 20.04 under ESM or Legacy Support where applicable.
What To Validate Now
- Inventory. Identify Ubuntu PHP packages and SAPIs, exact release and package version, Apache, FPM and other worker pools, container images, exposure, applications, owners, and Ubuntu Pro or Legacy Support entitlement.
- Establish applicability. Match each host or image to the exact Ubuntu release and package family. Do not substitute upstream version comparisons for Ubuntu package revision evidence.
- Remediate. Install the USN-listed PHP packages through the applicable Ubuntu channel, rebuild derived images, and restart every PHP and web-server worker so the fixed runtime is active.
- Validate. Confirm installed and running versions, verify all worker pools were replaced, test request, upload, session, error and memory-limit paths in scope, review relevant logs, and retain deployment evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Ubuntu package revisions differ from upstream PHP versions, and older releases require ESM or Legacy Support. Updating files without restarting every long-lived PHP or web-server worker leaves the vulnerable runtime active.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
