Yesterday, the PHP security team announced fixes for two critical vulnerabilities in PHP, to be released today at 14:00 UTC. CERT-EU’s advisory indicates they could allow unauthenticated remote code execution. No technical details will be public until the release of the patches.
Passbolt Cloud
We applied every mitigation available and we see no trace of exploitation on Passbolt Cloud. But with the scope of the vulnerabilities still unknown, we decided to go further and decided to switch Passbolt Cloud offline until the patch is released and deployed on our infrastructure. This follows CERT-EU’s recommendation to isolate internet-facing applications until a fix is available.
We know this is disruptive, and we didn’t take the decision lightly. A few hours without access is a better outcome than any risk to your data.
Your server runs PHP, so you’re concerned too. We recommend reading CERT-EU’s advice, checking which PHP version your instance runs on, and confirming whether it’s affected once PHP publishes the details. Note that PHP 8.1 and older won’t receive a fix. On our side, we’ll publish updated Docker images, DigitalOcean and OVA as soon as they’re ready.
The PHP security team has released the patch for CVE-2026-109618 and CVE-2026-109619.
The team is now updating Passbolt Cloud and the self-hosted images (Docker, OVA, DigitalOcean).
Passbolt Cloud will be restored once the update is deployed and verified.
Linux distributions are publishing patched PHP packages. Self-hosted administrators using Passbolt’s distribution packages can update PHP on their servers.
The fixed versions are listed on php.net.
Patched Docker images, AWS AMI and OVA are now published. Docker users can pull the latest image and redeploy. For existing AMI and OVA instances, update PHP through your system’s package manager: a new image only applies to new deployments.
DigitalOcean images are awaiting marketplace review, and the Helm chart update is in progress.
To wrap up: our review of Passbolt Cloud’s system logs found no evidence of exploitation, and we continue to monitor our infrastructure.
If you self-host Passbolt and haven’t updated PHP yet, please do it now. The incident page gathers everything in one place: the details published by PHP, the fixed versions, how to update each type of installation, and the status of each Passbolt image.
If you want more details on the incident, and the steps self-hosted users should take to update their PHP installations, check out the blog PHP2Shell Incident, What Should I Do
