Mitigation for PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

IMPORTANT NOTICE:

This vulnerability is located within the core PHP interpreter bundled with IceWarp, not within native IceWarp code. The following procedure serves as an immediate mitigation step to disable the vulnerable PHP engine feature prior to applying a full vendor patch update.

Step-by-Step Resolution

Step 1: Modify the primary php.ini file

1. Backup the php.ini file located in /icewarp/php/

2. Open the php.ini file using a text editor.

3. Locate the directive session.upload_progress.enabled.

4. If the line is commented out (starts with a semicolon ;), remove the semicolon.

5. Set the directive value to 0:

session.upload_progress.enabled=0

Step 2: Create the php.user.ini override file

1. In the same directory (/icewarp/php/), create a new text file named php.user.ini.

2. Add the following line to the file and save it:

session.upload_progress.enabled=0

Step 3: Restart the IceWarp Control Module

To force PHP to reload its runtime configuration, restart the IceWarp Control module.

For Linux:

Run the following in the terminal:

 icewarp/icewarpd.sh --restart control

For Windows:

Run the following in Command Prompt (Administrator) or PowerShell:

net stop "IceWarpControl" & net start "IceWarpControl"

Verification

1. Verify that the Control module service has restarted successfully and is active.

2. Ensure that php.user.ini has appropriate read permissions for the service user running IceWarp.