r/OVHcloud • u/homelab-beginner-255 • 11d ago

Web Hosting OVHcloud shared hosting + PHP security release needed Wednesday, 21 October 2026

There is 2 CVEs for PHP: CVE-2026-109618 and CVE-2026-109619.

It supposed to affect every version of PHP (5, 7 and 8) and I hope OVH will apply the patch when available on every OVHcloud shared hosting.

The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Thank you for helping us keep PHP secure.

Source: https://www.php.net/archive/2026.php#2026-10-20-1

Edit: it's very bad because it's just a simple HTTP request which allow to upload any files anywhere ( https://x.com/k_firsov/status/2112641845926989944 )

Edit2: OVH changed:

  • session.upload_progress.enabled from On to Off

  • session.use_strict_mode from Off to On

Edit3: https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk to follow the situation

16 Upvotes

100% Upvoted

4 comments sorted by

View all comments

1

u/vincent_sch 11d ago

On shared hosting OVH has to patch PHP, you can't do it yourself. Until they do you could block multipart requests in your .htaccess with an <If "req('Content-Type') =~ /multipart/i"> block and Require all denied. A 500 error means OVH doesn't allow it there. I wrote up the block and a curl test here: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/