Articles in this section

See more

Patch and mitigation of PHP Vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560

Avatar
Petr Štěrba
  • Updated
Follow
Applies to: IceWarp Server 14.3, 14.2, 14.1 and older versions

Summary

Vulnerabilities have been disclosed in PHP and are tracked as CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. IceWarp Server bundles PHP, so installations running an unpatched PHP version may be affected.
IceWarp is providing packages with a patched PHP for supported versions. Customers should apply the patch matching their IceWarp version and operating system as soon as possible.
 

Affected versions and available patches

IceWarp Version Bundled PHP Patch Available Available Downloads / OS Support
EPOS Update 3 (14.3.0.X) PHP 8.4 Yes Windows • Red Hat 8 • Red Hat 9
EPOS Update 2 (14.2.0.X) PHP 8.2 Yes Windows • Red Hat 7 • Red Hat 8 • Red Hat 9
EPOS Update 1 (14.1.0.X) PHP 8.2 Yes Windows • Red Hat 7 • Red Hat 8 • Red Hat 9
Older versions PHP 7.3 No official PHP patch  See “Older versions” below

Installing the patched PHP

Step 1: Stop the IceWarp Control Service

  • Linux:

    /opt/icewarp/icewarpd.sh --stop control

  • Windows (Admin Command Prompt / PowerShell):

    net stop "IceWarpControl"

Step 2: Backup Existing PHP Folder

  • Linux:

    mv /opt/icewarp/php /opt/icewarp/php-bak

  • Windows: 

    Rename the php directory to php-bak

Step 3: Deploy Patched PHP Folder

  • Copy your extracted, patched php directory into [icewarp-installdir]/php.

Step 4: Restore Configuration Files

  • Copy php.ini and php.user.ini from php-bak/ into the new php/ folder:

Step 5: Restore Temporary Files

  • Linux: Copy the contents of php-bak/tmp/ into php/tmp/

  • Windows: Copy the contents of php-bak/temp/ into php/temp/

Step 6: Fix File Permissions (Linux Only)

  • Linux only: Run chown on the new php folder so that its ownership matches the rest of the IceWarp installation. (for example: chown -R icewarp:icewarp /opt/icewarp/php).

Step 7: Restart the IceWarp Control Service

  • Linux:

    /opt/icewarp/icewarpd.sh --restart control

  • Windows:

    net stop "IceWarpControl" & net start "IceWarpControl"

Permanent fix in future releases

Future IceWarp releases will include the patched PHP by default:
  • IceWarp 14.3.0.14 and later
  • IceWarp 14.2.0.17 and later
Customers who upgrade to these versions or newer do not need to install the patch packages separately.

Older versions (bundling PHP 7.3)

IceWarp versions older than 14.1 bundle PHP 7.3. The PHP project has not yet released an official patch for this branch, so no patched package can be provided.
As a partial measure, we continue to recommend changing the following settings in php.ini:
session.upload_progress.enabled = 0
memory_limit = -1
post_max_size = 32M
upload_max_filesize = 32M
session.serialize_handler = php
Important: These settings do not fully mitigate the vulnerabilities. Customers running older versions are strongly advised to upgrade to a newer version of IceWarp and apply the patches listed above.
 
!!! The changes above will limit the upload limit of files to 32 MB !!!
 

Recommended actions

Modify the primary php.ini file

  1. Backup the php.ini file located in /icewarp/php/

  2. Open the php.ini file using a text editor.

  3. Locate the variables stated below.

  4. If any of the variables are commented out (starts with a semicolon ;), remove the semicolon.

  5. Set the variables to their specific value

Create the php.user.ini override file

  1. In the same directory (/icewarp/php/), create a new text file named php.user.ini.

  2. Add the following lines to the file and save it:

session.upload_progress.enabled = 0
memory_limit = -1
post_max_size = 32M
upload_max_filesize = 32M
session.serialize_handler = php

If you are already on the patched version, you can revert the changes above to the original state.

 

Vulnerability CVE-2026-115560

Regarding this recently disclosed vulnerability, please apply the following configuration again in php.ini:

session.upload_progress.enabled=0

Related articles

Comments

0 comments

Article is closed for comments.