© FileRun Lda | Portugal
Made in Europe 
Security advisory, 21 October 2026
Two critical vulnerabilities in PHP let an attacker run code on your server without signing in.
Update PHP today, or pull the latest FileRun Docker image.
On 21 October 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix CVE-2026-109618 and CVE-2026-109619.
With either of them, a request from the internet can run code on the server. The attacker does not need an account.
The problem is in PHP, not in FileRun, so every PHP application is affected. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected.
The attack can happen before FileRun receives the request, so no FileRun setting can prevent it. You do not need a FileRun update. You need the fixed PHP version.
The technical details are in the PHP security advisory.
The image already contains the fixed PHP version.
In the folder of your docker-compose.yml file, run these two commands:
docker compose pull
docker compose up -d
The first command downloads the new image. The second command creates the container again from it.
The image contains only the server environment. Your files, your settings and your database are in the volumes, and they stay as they are.
If you started the container with docker run, pull the image with the same name and tag, for example docker pull filerun/filerun:2026.03. Then remove the container, and start it again with the same options.
FileRun runs on PHP 8.3, 8.4 and 8.5. The fixed versions are 8.3.36, 8.4.27 and 8.5.12.
Linux distributions received the fix before the announcement. Their packages often keep the old version number, but they contain the fix. Check the security notice of your distribution.
Restart PHP-FPM, or Apache if it runs PHP as mod_php. A PHP process that is still running uses the old code.
The update stays on the same PHP version, for example from 8.4.26 to 8.4.27. The FileRun files and the ionCube Loader do not change.
PHP 8.2 receives the fix in 8.2.35. PHP 8.1 and older receive no fix from the PHP project. Some Linux distributions and support vendors still send fixes for them, so ask your vendor.
Otherwise, upgrade to PHP 8.4 or 8.5. A new PHP version needs new FileRun application files, as the documentation explains.
If a hosting company runs PHP for you, ask them if the update is installed.
On 21 October, the PHP project announced that rpms.remirepo.net would not have the update that day. It recommends the packages of your distribution, or PHP built from source.
Only the update fixes the problem.
The PHP security advisory lists PHP settings that reduce the risk. They do not make the server safe. Use them only until you can update.
Some of them change the upload and memory limits of PHP. Check that uploads in FileRun still work after you change them.
© FileRun Lda | Portugal