Mitigation for PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

IMPORTANT NOTICE:

This vulnerability is located within the core PHP interpreter bundled with IceWarp, not within native IceWarp code. The following procedure serves as an immediate mitigation step to disable the vulnerable PHP engine feature prior to applying a full vendor patch update.

Step-by-Step Resolution

Step 1: Modify the primary php.ini file

1. Backup the php.ini file located in /icewarp/php/

2. Open the php.ini file using a text editor.

3. Locate the variables stated below.

4. If any of the variables are commented out (starts with a semicolon ;), remove the semicolon.

5. Set the variables to thir specific value:

session.upload_progress.enabled=0
memory_limit=-1
post_max_size=32M
upload_max_filesize=32M

!!! This action will limit the upload size of any file to 32MB !!!

Step 2: Create the php.user.ini override file

1. In the same directory (/icewarp/php/), create a new text file named php.user.ini.

2. Add the following lines to the file and save it:

session.upload_progress.enabled=0
memory_limit=-1
post_max_size=32M
upload_max_filesize=32M

Step 3: Restart the IceWarp Control Module

To force PHP to reload its runtime configuration, restart the IceWarp Control module.

For Linux:

Run the following in the terminal:

 icewarp/icewarpd.sh --restart control

For Windows:

Run the following in Command Prompt (Administrator) or PowerShell:

net stop "IceWarpControl" & net start "IceWarpControl"

Verification

1. Verify that the Control module service has restarted successfully and is active.

2. Ensure that php.user.ini has appropriate read permissions for the service user running IceWarp.