The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow for remote code execution in PHP and should be addressed immediately by updating to the latest PHP version. Large parts of openITCOCKPIT are build using PHP, especially on the main server and satellite systems. Due to the two vulnerabilities are in the programming language itself, please see the official PHP security advisories for more information:
To update your openITCOCKPIT installation, simply run the following commands:
Ubuntu and Debian users
apt-get update
apt-get dist-upgrade
RedHat, AlmaLinux, Rocky Linux users
dnf --refresh check-update
dnf update
The issue is fixed in this versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Distribution Patch Status
- For Ubuntu please see: https://ubuntu.com/security/CVE-2026-109618
- For Debian please see: https://security-tracker.debian.org/tracker/CVE-2026-109618
You can use the command php -v to check your current PHP version and verify that the update has been applied successfully.
root@srvphp01:~# php -v
PHP 8.4.27 (cli) (built: Oct 21 2026 07:53:46) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.27, Copyright (c) Zend Technologies
with Zend OPcache v8.4.27, Copyright (c), by Zend Technologies
Your openITCOCKPIT Team