PHP vulnerabilities

The PHP vulnerabilities check assesses discovered PHP installations on Windows, Linux, and macOS (x64 and Arm64) for CVE-2026-109618 and CVE-2026-109619 based on their versions. It runs on the device, every 60 minutes by default. It does not attempt exploitation and is not a general PHP vulnerability scanner.

Prerequisites

• The octoja agent is installed and connected on the device.
• The agent can read the PHP files and relevant directories to be checked.

Steps

1. Go to Devices and open the device.
2. In the Checks tab, click Add Check → PHP vulnerabilities.
3. For installations outside the usual directories, add Additional paths.
4. Click Add Check.
5. After the first run, open the result. Review both the discovered installations and Coverage gaps.

For many devices, assign the check through a config package.

Settings

The check discovers PHP through running processes, common installation directories, PATH, and web server configurations. On Linux it also uses package inventory (dpkg-query or rpm); on Windows it also uses IIS configurations and Windows services. This includes PHP CLI, CGI/FPM, and Apache PHP modules where discoverable through these sources.

Results

The detail view shows each installation's Path, Version, Package (if associated), result, and reason. The overall result is the worst severity across installations and coverage gaps.

The check uses these minimum versions from the PHP security advisory dated October 21, 2026:

For coverage gaps, check the listed paths, access permissions, and availability of package or process queries. For installations that were not found, add narrowly targeted paths rather than large directory trees.

FAQ

Why does an updated Linux package still show a warning?

Distributions may backport security fixes without increasing the displayed PHP upstream version. The check does not verify these backports automatically. Compare the displayed package and version with your distribution or package vendor's security advisories for both CVEs. A warning alone does not confirm that the installation is vulnerable.

What should I do after updating PHP?

Restart the affected PHP-FPM/CGI workers or web servers according to your vendor's instructions, then run the check again. The check does not verify that all workers have loaded the fixed version. Also remove obsolete installations or update them as well.

Why is a discovered installation's version unknown?

A discovered file does not always provide an assessable version. On Linux and macOS, the check only executes PHP to read its version if the file and all parent directories are owned by root and are not group- or world-writable. For modules, it uses the associated Linux package version if available. Review unknown versions manually; do not loosen file permissions for this purpose.

See also: Set up alerts for a check