{"article":{"id":52154202993041,"url":"https://icewarp.zendesk.com/api/v2/help_center/en-us/articles/52154202993041.json","html_url":"https://support.icewarp.com/hc/en-us/articles/52154202993041-Patch-and-mitigation-of-PHP-Vulnerabilities-CVE-2026-109618-CVE-2026-109619-and-CVE-2026-115560","author_id":370744548597,"comments_disabled":true,"draft":false,"promoted":true,"position":0,"vote_sum":9,"vote_count":31,"upvote_count":20,"downvote_count":11,"section_id":19244172564113,"created_at":"2026-10-21T10:28:30Z","updated_at":"2026-10-26T15:30:21Z","name":"Patch and mitigation of PHP Vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560","title":"Patch and mitigation of PHP Vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-10-26T15:30:21Z","user_segment_id":null,"permission_group_id":226468,"content_tag_ids":[],"label_names":[],"body":"
\nApplies to: IceWarp Server 14.3, 14.2, 14.1 and older versions

Summary

Vulnerabilities have been disclosed in PHP and are tracked as CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. IceWarp Server bundles PHP, so installations running an unpatched PHP version may be affected.
IceWarp is providing packages with a patched PHP for supported versions. Customers should apply the patch matching their IceWarp version and operating system as soon as possible.
 

Affected versions and available patches

 
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IceWarp VersionBundled PHPAvailable Downloads / OS Support
\n
EPOS Update 3
\n
(14.3.0.X)
\n
 
\n		PHP 8.4
\n
EPOS Update 2
\n
(14.2.0.X)
\n
 
\n		PHP 8.2
\n
EPOS Update 1
\n
(14.1.0.X)
\n
 
\n		PHP 8.2
\n
EPOS
\n
(14.0.0.X)
\n
 
\n		PHP 7.3
\n
Deep Castle 2
\n
Update 3
\n
(13.0.3.X)
\n
 
\n		PHP 7.3

Installing the patched PHP

\n

Step 1: Stop the IceWarp Control Service

\n
    \n
  • \n

    Linux:

    \n
    /opt/icewarp/icewarpd.sh --stop control
    \n
    • \n
  • \n

    Windows (Admin Command Prompt / PowerShell):

    \n
    net stop \"IceWarpControl\"
    \n
    • \n
\n

Step 2: Backup Existing PHP Folder

\n
    \n
  • \n

    Linux:

    \n
    mv /opt/icewarp/php /opt/icewarp/php-bak
    \n
    • \n
  • \n

    Windows: 

    \n

    Rename the php directory to php-bak

    \n
    • \n
\n

Step 3: Deploy Patched PHP Folder

\n

  • Copy your extracted, patched php directory into [icewarp-installdir]/php.

\n

Step 4: Restore Configuration Files

\n

  • Copy php.ini and php.user.ini from php-bak/ into the new php/ folder:

\n

Step 5: Restore Temporary Files

\n
    \n

  • Linux: Copy the contents of php-bak/tmp/ into php/tmp/

    • \n

  • Windows: Copy the contents of php-bak/temp/ into php/temp/

    • \n
\n

Step 6: Fix File Permissions (Linux Only)

\n
  • \nLinux only: Run chown on the new php folder so that its ownership matches the rest of the IceWarp installation. (for example: chown -R icewarp:icewarp /opt/icewarp/php).
\n

Step 7: Restart the IceWarp Control Service

\n
    \n
  • \n

    Linux:

    \n
    /opt/icewarp/icewarpd.sh --restart control
    \n
    • \n
  • \n

    Windows:

    \n
    net stop \"IceWarpControl\" & net start \"IceWarpControl\"
    \n
    • \n
\n

Step 8: Mitigation of Vulnerability CVE-2026-115560

    \n

  1. Backup the php.ini file located in /icewarp/php/

    2. \n

  2. Open the php.ini file using a text editor.

    3. \n

  3. Locate the variable stated below.

    4. \n

  4. If the variable is commented out (starts with a semicolon ;), remove the semicolon.

    5. \n

  5. Set the variable to the specific value

    6. \n
session.upload_progress.enabled=0
    \n

  1. In the same directory (/icewarp/php/), create a new text file named php.user.ini.

    2. \n

  2. Add the following lines to the file and save it:

    3. \n
session.upload_progress.enabled = 0

 

Permanent fix in future releases

Future IceWarp releases will include the patched PHP by default:
Customers who upgrade to these versions or newer do not need to install the patch packages separately.

Older versions:

IceWarp versions older than 13.0.2 The PHP project has not yet released an official patch for this branch, so no patched package can be provided.
As a partial measure, we continue to recommend changing the following settings in php.ini:
session.upload_progress.enabled = 0\nmemory_limit = -1\npost_max_size = 32M\nupload_max_filesize = 32M\nsession.serialize_handler = php
\n
\nImportant: These settings do not fully mitigate the vulnerabilities. Customers running older versions are strongly advised to upgrade to a newer version of IceWarp and apply the patches listed above.
\n
 
\n
!!! The changes above will limit the upload limit of files to 32 MB !!!
\n
 

Recommended actions

Modify the primary php.ini file

    \n

  1. Backup the php.ini file located in /icewarp/php/

    2. \n

  2. Open the php.ini file using a text editor.

    3. \n

  3. Locate the variables stated below.

    4. \n

  4. If any of the variables are commented out (starts with a semicolon ;), remove the semicolon.

    5. \n

  5. Set the variables to their specific value

    6. \n

Create the php.user.ini override file

    \n

  1. In the same directory (/icewarp/php/), create a new text file named php.user.ini.

    2. \n

  2. Add the following lines to the file and save it:

    3. \n
\n
session.upload_progress.enabled = 0\nmemory_limit = -1\npost_max_size = 32M\nupload_max_filesize = 32M\nsession.serialize_handler = php
\n
\n

If you are already on the patched version, you can revert the changes above to the original state.

\n

session.upload_progress.enabled = 0 - Must remain in the files even on patched version.

\n

 

\n
\n
"}}