Oct 22, 2026
Every ScopServ server running PHP 7.4 on Rocky Linux 8 must move to php 7.4.33-8.module+el8.10.0+40393+c071e357 (released October 21, 2026), which fixes CVE-2026-109618 and CVE-2026-109619. The php74-security-update.sh script applies the update and verifies the fixed build is installed.
Both CVEs ("PHP2Shell", disclosed October 21, 2026) are flaws in the PHP engine itself, so a site is exposed even if its own code is clean. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution on PHP-FPM, mod_php, php-cgi and other web SAPIs.
| CVE | Flaw | CVSS v4.0 | Fixed in (Rocky Linux 8) |
|---|---|---|---|
| CVE-2026-109618 | Memory corruption when PHP runs out of memory during request processing; cleanup uses partly initialized data. Triggerable with crafted multipart requests within configured size limits. | 9.2 | php 7.4.33-8 (RLSA-2026:87080) |
| CVE-2026-109619 | Use-after-free across requests: state left by one request points to freed memory reused by a later request on the same worker. | 9.2 | php 7.4.33-8 (RLSA-2026:87080) |
Vector for both: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. PHP published no official 7.4 release, only source backports; the Rocky Linux 7.4.33-8 package carries the fix. Public PoCs exist but are not broadly reliable; exploitation attempts have been reported since disclosure (Rapid7, Tenable).
If a server cannot be updated right away, reduce exposure (not a complete fix): set memory_limit=-1 and session.upload_progress.enabled=0 in the system php.ini so applications cannot override them, then run systemctl restart scopserv.
Any Rocky Linux 8 server with the php:7.4 module stream installed at a version older than 7.4.33-8 is affected. To check a server:
rpm -q php-common
7.4.33-8.module+el8.10.0+40393+c071e357: **fixed**.All php-* packages of the module (cli, fpm, mysqlnd, gd, ldap, mbstring, opcache, pdo, snmp, xml, etc.) move to the same version. php-pecl-zip is not affected and stays at 1.18.2-1.
The script updates PHP from the Rocky Linux repositories, then fails (exit code 1) unless the installed version is exactly the fixed build.
/etc/rocky-release).php:7.4 module stream (dnf -y module enable php:7.4).dnf clean all) to force fresh repository metadata.dnf update php). This step asks for confirmation: answer y.php-common is 7.4.33-8.module+el8.10.0+40393+c071e357 and that php -v shows built: Oct 21 2026.On success it prints SUCCESS: PHP security update verified!. The script does not restart any service.
Run the following as root on each affected server, during a maintenance window (PHP pages may error for a few seconds while packages are replaced).
Download the script:
wget --no-check-certificate -O /var/www/scopserv/scripts/php74-security-update.sh https://scm.scopserv.com/files/1/4/f/14f9fbf5f11fe3d82bd5f53e3ae1ca05.phps
Run the script and answer y when DNF asks to confirm the update:
sh /var/www/scopserv/scripts/php74-security-update.sh
Restart the scopserv web service with systemctl restart scopserv.
The certificate of scm.scopserv.com validates normally, so --no-check-certificate is not needed; dropping it protects against a tampered download being run as root.
The server is fixed when the script ends with SUCCESS: PHP security update verified!. To check by hand:
rpm -q php-common
php -v | head -1
rpm -q --changelog php-common | head -3
Expected output:
php-common-7.4.33-8.module+el8.10.0+40393+c071e357.x86_64
PHP 7.4.33 (cli) (built: Oct 21 2026 17:33:12) ( NTS )
* Wed Oct 21 2026 Jitka Plesnikova <jplesnik@redhat.com> - 7.4.33-8
- Avoid state corruption via bailout
CVE-2026-109618, CVE-2026-109619
Also check that every PHP package is on the same release: rpm -qa 'php*' | sort should list only 7.4.33-8 builds (plus php-pecl-zip-1.18.2-1).
| Script message | Cause | What to do |
|---|---|---|
This script must be run as root. | Not run as root | Run again as root. |
This script requires Rocky Linux 8. | Not a Rocky Linux 8 host | Do not use this script; patch through that OS's own channel. |
Operation aborted. (from DNF), then the script exits | Confirmation answered N, or run without a terminal (cron, piped) | Run again interactively and answer y. |
Expected PHP RPM release not installed. | The mirror does not carry 7.4.33-8 yet, or another php stream is enabled | dnf clean all, check dnf module list php shows 7.4 [e], try again later if the mirror lags. |
Expected PHP RPM release not installed. (installed release ends in .remi or another vendor tag) | PHP comes from another repository (e.g. Remi), which ships its own fix under a different release number | The script does not apply: do not switch repositories. Find the origin with dnf list installed 'php*', update from that repository (dnf update 'php*'), then confirm rpm -q --changelog php-common lists CVE-2026-109618 and CVE-2026-109619. If it does not, the vendor has not shipped the fix yet. |
PHP build date does not match Oct 21 2026. | The php in PATH is not the RPM build | Check which php points to /usr/bin/php. |
Rollback (only if the new build breaks something): dnf downgrade 'php*' returns to the previous release in the repository, which is **vulnerable**. Plan to re-apply the fix.
php-common-7.4.33-8.module+el8.10.0+40393+c071e357 (rpm -q --changelog php-common) — the source for the fix description and CVE IDs above.scripts/php74-security-update.sh in the ScopServ core repository, commit 852b950).