PHP CVE Remediation - October 21 2026

This document will break down how to patch your Diskover system for the two CVEs released today RCE via OOM corruption (CVE-2026-109618) and RCE via stale global state (CVE-2026-109619). Additional detailed about these vulnerabilities can be found here: https://www.php.net/archive/2026.php#2026-10-21-5

As PHP is packaged as part of Diskover Web the following updates will need to occur on your Diskover Web host! There is an Online Method & Offline Method in this document. Please refer to the solution that best fits your environment.

The examples provided here assume a base version of 8.4.x if you’re running a 8.2.x or 8.3.x version then check the CVE for guidance on the updated patch version and adjust accordingly.

Online Method (machines have outbound access)

Rocky / RHEL Linux

• Determine if the remi-safe repo is enabled on your Diskover Web :

  • dnf repolist | grep remi 
    remi-safe                       Safe Remi's RPM repository for Enterprise Linux 9 - aarch64

  • If the repo shows as above then it’s already enabled. If you do not see this repo validate that the repo file exist :

    ls -ll /etc/yum.repos.d/remi-safe.repo
    -rw-r--r-- 1 root root 1009 Oct 21 11:46 /etc/yum.repos.d/remi-safe.repo

  • Enable the remi-safe.repo :

    • sed -i.bak '/^\[remi-safe\]$/,/^$/ s/^enabled=0$/enabled=1/' /etc/yum.repos.d/remi-safe.repo

  • If you do not have a /etc/yum.repos.d/remi-safe.repo file, create it. vi /etc/yum.repos.d/remi-safe.repo:

    # This repository is safe to use with RHEL/CentOS base repository
    # it only provides additional packages for the PHP stack
    # all dependencies are in base repository or in EPEL
    
    [remi-safe]
    name=Safe Remi's RPM repository for Enterprise Linux $releasever_major - $basearch
    #baseurl=http://rpms.remirepo.net/enterprise/$releasever_major/safe/$basearch/
    #mirrorlist=https://rpms.remirepo.net/enterprise/$releasever_major/safe/$basearch/httpsmirror
    mirrorlist=http://cdn.remirepo.net/enterprise/$releasever_major/safe/$basearch/mirror
    enabled=1
    gpgcheck=1
    # can be enabled if not behind a proxy because of possible cache issue
    repo_gpgcheck=0
    gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi.el$releasever_major

• Update the DNF Cache to fetch the latest packages :

  • dnf makecache --refresh --repo remi-safe

• Update the PHP packages to 8.4.27 :

  • dnf upgrade 'php*' --disablerepo="*" --enablerepo="remi-safe"

• Ensure proper ownership of the updated PHP directory tree :

  • chown -R nginx:nginx /var/opt/remi/php84/lib/php/

• Restart the PHP & Nginx services :

  • systemctl restart php-fpm nginx ; systemctl status php-fpm nginx

Offline Method (air-gapped / no outbound access)

Rocky / RHEL Linux

• Reach out to the Diskover team in a Zendesk ticket for the updated PHP packages. They contain v8.4.27 at the time of this writing.

• Place this package onto the Diskover Web host.

• Run the following to untar the package into /tmp/:

  • sudo tar xzf php84-8.4.27-el9-offline.tgz -C /tmp/

• Copy the local PHP repo file into place:

  • sudo cp /tmp/php84/offline-php.repo /etc/yum.repos.d/offline-php.repo

• Upgrade PHP:

  • sudo dnf upgrade 'php*' --disablerepo='*' --enablerepo=offline-php

• Ensure proper ownership of the updated PHP directory tree:

  • chown -R nginx:nginx /var/opt/remi/php84/lib/php/

• Restart the PHP-FPM service:

  • sudo systemctl restart php-fpm

• Validate v8.4.27 is the version listed:

  • php84 -v

• Clean up the artifacts:

  • rm -rf /tmp/php84/