Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Bitpalast]

Regarding the Brotli desaster I want to make you aware that updating the libraries won't be enough (e.g. when your operating system updates them). You'll also need to restart the services that depend on them, and this also applies to the service if it only links dynamically to the Brotli library. The reason is that services load the library when they start. If the library is updated, it does not change in the memory of the service, so the service still uses the previous version that can be attacked.

What you should restart is definitely all php-fpm services. What you normally do not need to restart are Nginx and Apache, as both route incoming traffic through to the endpoint without decompressing it. If you are using Node, Ruby, Bun etc., restarts are required.

On the command line, I'd suggest to run python3 -c "import pkg_resources; [print(f'{d.project_name}: {d.version}') for d in pkg_resources.working_set if d.project_name.lower() in ['brotli', 'brotlicffi']]" once, just to make sure that your Python does not use the Brotli package by default. No output = no problem.

Finally, another piece of unasked advice: Your distributor might backport the updated Brotli files, so that they still carry version numbers that appear to be affected by the flaw. However, you can find out what the real update status is by querying the package manager, for example for Alma/RHEL it would be
rpm -q --changelog brotli | grep -i "CVE-2026-111497" or to see the first few lines rpm -q --changelog brotli | head -n 5.

 

[pleskuser67553]

Regarding the Brotli desaster I want to make you aware that updating the libraries won't be enough (e.g. when your operating system updates them). You'll also need to restart the services that depend on them, and this also applies to the service if it only links dynamically to the Brotli library. The reason is that services load the library when they start. If the library is updated, it does not change in the memory of the service, so the service still uses the previous version that can be attacked.

What you should restart is definitely all php-fpm services. What you normally do not need to restart are Nginx and Apache, as both route incoming traffic through to the endpoint without decompressing it. If you are using Node, Ruby, Bun etc., restarts are required.

On the command line, I'd suggest to run python3 -c "import pkg_resources; [print(f'{d.project_name}: {d.version}') for d in pkg_resources.working_set if d.project_name.lower() in ['brotli', 'brotlicffi']]" once, just to make sure that your Python does not use the Brotli package by default. No output = no problem.

Finally, another piece of unasked advice: Your distributor might backport the updated Brotli files, so that they still carry version numbers that appear to be affected by the flaw. However, you can find out what the real update status is by querying the package manager, for example for Alma/RHEL it would be
rpm -q --changelog brotli | grep -i "CVE-2026-111497" or to see the first few lines rpm -q --changelog brotli | head -n 5.

I started a separate thread for the Brotli CVE Issue - Brotli CVE-2026-111497

 

[brother4]

Next vulnerability—no Ubuntu fix available yet. So I've temporarily patched it as follows:

sudo nft add table inet cve_2026_98432
sudo nft 'add chain inet cve_2026_98432 input { type filter hook input priority -310; policy accept; }'
sudo nft add rule inet cve_2026_98432 input ip protocol tcp ip hdrlength gt 5 counter drop
sudo nft list table inet cve_2026_98432

CVE-2026-98432 | Ubuntu

Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.

ubuntu.com

This disables IP Options, which you generally don't need for a web server anyway. However, this setting isn't persistent, so it won't survive a reboot.