Today the PHP project published two critical security advisories, CVE-2026-109618 and CVE-2026-109619. The security community calls the pair PHP2Shell. Both are rated 9.2 out of 10, and both let an attacker run their own code on a web server without logging in.
Octeth runs on PHP. Every self-hosted Octeth installation, on every version up to and including v6.0.1, uses PHP builds that are affected. I want you to hear that from us directly, together with what we have done about it and what happens next.
The short version:
- This is a flaw in PHP itself, not in Octeth's code. Any application running on the same PHP setup is exposed in the same way.
- We have no evidence that any Octeth installation was attacked.
- The fix is built and merged. It ships in Octeth v6.0.2, which is not available to download yet.
- Upgrade to v6.0.2 as soon as it is released tomorrow, October 22. Until then, installations stay exposed.
- If we host Octeth for you, you do not need to do anything. We manage those cloud installations and will update them ourselves.
What PHP2Shell Is
Both flaws are in the PHP runtime, the layer that receives a web request before any application code sees it. That is what makes them serious: it does not matter how carefully an application checks its input, because the problem sits underneath the application. The researchers demonstrated full remote code execution on Apache with PHP running as a module, which is the setup all of Octeth's web containers use.
Security researchers report that these flaws are being exploited in the wild against PHP sites in general. Details leaked before the planned disclosure date, so the usual quiet period between the fix and public knowledge of the flaw was much shorter than normal.
How It Affects Octeth
Octeth's standard Docker setup has three web-facing parts, and each runs Apache with PHP:
- The classic user and admin interface, the API, and the public tracking, subscribe and unsubscribe endpoints.
- The system backend.
- The new user interface.
The PHP builds in all three, as shipped up to v6.0.1, are unpatched. Because the tracking and subscription endpoints have to be reachable from the internet for email to work, the exposure is real for every installation, not only the ones with a public admin login.
If an attacker exploited it, the risk is a takeover of the server, which would expose the data stored on it. Again: we have no indication that this has happened to any Octeth installation.
What We Changed
We started on this as soon as the advisories were out today, and the fix was merged the same day. Octeth v6.0.2 includes:
- Patched PHP in every web container. Every PHP version in the Octeth server image is now a patched build.
- A build that refuses to ship unpatched PHP. The image build now fails if any PHP version resolves to a build older than the patched one. A slow mirror or a lagging package can no longer slip an old PHP into a release.
- A pinned PHP version for the new interface, so an older cached copy cannot be reused when an installation upgrades.
- An unused PHP feature switched off. PHP's upload progress reporting is on by default, and Octeth has never used it. It is now switched off in all three web containers, as a second layer of protection on top of the patched PHP.
The same release also moves Octeth's build tooling from Node.js 20 to Node.js 24. In Octeth, Node.js only runs while the interface is being built and is not exposed to the internet, so this is routine maintenance rather than an exposure.
What Is Still Pending
The fixed server image has to be built for both Intel/AMD and ARM servers. As of this evening, some of the patched PHP builds for ARM have not been published upstream yet. We are watching for them and will build and publish the image as soon as they land. v6.0.2 is scheduled for tomorrow, October 22, and I will update this post when it is available.
What You Should Do
If you run Octeth on your own servers, upgrade to v6.0.2 as soon as it is released. If we host Octeth for you, we will do this for you. It is a normal Octeth upgrade, and it moves your installation to the patched image on its own. You do not need to change any configuration.
One detail to be aware of: some of the patched PHP builds report the same version number as the vulnerable ones. The version you see in a PHP info page will not tell you whether you are patched. Running v6.0.2 will.
The changelog will cover the technical details for operators when v6.0.2 is out. If you have questions about your own installation in the meantime, contact us and we will help.
Security problems in the layers underneath your software are not something you can prevent, but how quickly you respond to them is. We will keep you informed until every installation can be patched.
Already an Octeth client? Log in to the Octeth Client Portal to download the latest version.
Running your own email infrastructure and want a team that watches the whole stack? Tell us about your setup through the contact form at octeth.com/demo/.
