PHP2Shell: patched PHP packages for grommunio available now
Updated PHP packages that mitigate the critical PHP2Shell vulnerabilities are now available in both the grommunio community and supported repositories. We strongly recommend that you secure your systems now.
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in the PHP runtime itself, CVE-2026-109618(opens in a new tab) and CVE-2026-109619, each rated CVSS 9.2. They can allow an unauthenticated attacker to execute code remotely with a single request, before any application code runs. That means a server can be exposed even when the PHP applications on it are perfectly secure.
- CVE-2026-109618: an allocation interrupted by an out-of-memory condition can leave request data partly initialised, and request cleanup may then treat that invalid data as valid.
- CVE-2026-109619: request-owned internal state can outlive the memory it points to, so a later request on the same worker may use it before it is reset.
Every PHP installation that serves web requests is affected, including PHP-FPM, which grommunio uses. Details of the flaws leaked before the coordinated disclosure date, and security researchers already report exploitation attempts in the wild. Upstream PHP has released fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) and says that updating is the only safe option, because the available workarounds close only some attack paths.
Further reading: Help Net Security, The Hacker News, SecurityWeek and the watchTowr FAQ.
How to update
Updating takes only a few commands:
zypper ref
zypper up
zypper in php8-opcache
systemctl restart php-fpmInstead of zypper ref and zypper up, you can also use the web updater in grommunio Admin or run grommunio-update on the command line. Either way, restart php-fpm afterwards: that makes sure that every worker runs the patched PHP binary.
Our automated tests and a large number of manual validation checks have not revealed any side effects. That said, at this early stage nobody anywhere can guarantee that there are none. All of our testing checks out, and the mitigations have proven effective in all of our lab setups.
Bonus: a faster web interface with OPcache
For a while now, you have also been able to install php8-opcache with grommunio. OPcache keeps precompiled PHP code in memory, which makes grommunio Web noticeably faster. That is why the command zypper in php8-opcache is included above. If you already have it installed, zypper simply skips it.
Out-of-band packages, ahead of the official SUSE updates
These packages are out-of-band updates that we built and provide ourselves, separate from the official packages supplied by SUSE. Thanks to our build infrastructure and testing pipeline, we were able to ship them before official SUSE maintenance updates were available. We are proud of that, and grateful to our team for the fast turnaround.
As soon as SUSE publishes its own fixed PHP packages, we will remove our interim packages from the grommunio repositories so that the SUSE-provided packages take precedence again. Because the packages on your system will then come from a different vendor (and possibly carry a lower version number), zypper will not switch back automatically. When that time comes, you will need to allow the vendor change explicitly, for example:
zypper ref
zypper up --allow-vendor-change --allow-downgrade
systemctl restart php-fpmWe will announce when that step is due, together with the exact instructions.
Not running grommunio on SUSE?
On Debian, Ubuntu and other distributions, PHP comes from your distribution. Install the PHP security updates provided by your distribution and restart php-fpm afterwards.
Questions?
More is coming. Discussions and the latest updates are in our community. Customers with a subscription can contact grommunio support directly.
