Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as php2shell, were disclosed on 21 October 2026. These vulnerabilities can potentially allow unauthenticated attackers to execute malicious code remotely on affected servers.
At uKnowva HRMS, the security of our customers' data and infrastructure remains a priority. Our technical team has initiated immediate mitigation measures and is preparing a permanent fix to address these vulnerabilities.
Understanding the PHP Vulnerabilities
Both vulnerabilities affect the PHP engine itself rather than the application code.
-
CVE-2026-109618: A memory-handling flaw triggered by out-of-memory conditions during request processing.
-
CVE-2026-109619: A flaw involving internal request data that may persist beyond its intended lifetime and be reused by a subsequent request.
Both vulnerabilities carry a critical severity rating of CVSS v4.0 9.2 and may enable remote code execution on affected systems.
PHP versions up to 8.5.11 are affected, with security fixes available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and earlier versions are no longer supported by the PHP project and do not receive official security updates.
Understanding the Risk
These vulnerabilities pose a significant risk to internet-facing PHP applications. Exploitation attempts were observed as early as 17 October 2026, before the official disclosure on 21 October 2026.
The level of exposure depends on the server configuration and how the application is accessed. The key risk factors include:
|
Risk Factor |
Why It Matters |
|
Apache with mod_php |
This configuration carries a higher risk because the vulnerability can be triggered before the application loads. |
|
Login-protected access |
Login requirements alone do not prevent these attacks, as the vulnerability exists in the PHP engine and can be triggered before authentication checks run. |
|
Internet-facing access |
Applications exposed to the internet face greater risk because attackers may be able to send malicious requests directly to the server. |
What this means for uKnowva customers
Although login requirements help protect application features, they do not eliminate this PHP-level vulnerability. Restricting access to approved office or VPN IP addresses provides an additional layer of protection and is recommended wherever possible.
These risks are why uKnowva is applying immediate mitigations and preparing to migrate to PHP 8.5.12, which fixes both vulnerabilities.
Our Immediate Action Plan
Our team is implementing temporary mitigations across uKnowva servers while preparing to migrate to PHP 8.5.12, which addresses both vulnerabilities.
Our action plan includes the following measures:
1. Strengthening Request and Memory Controls
We are reviewing request sizes, file upload limits, memory consumption, and resource-intensive operations. Server-level memory controls and Apache request limits are being applied to reduce exposure to oversized or malformed requests.
2. Disabling PHP Session Upload Progress
The PHP session upload progress feature is being disabled because it is associated with a confirmed attack path for CVE-2026-109619 and is not required by uKnowva features.
3. Reviewing Server Configuration
We are reviewing PHP and Apache configurations, removing invalid or deprecated settings where necessary, and restarting Apache to ensure updated settings take effect across all workers.
4. Monitoring for Suspicious Activity
Our team is reviewing server logs and files for unusual requests, unexpected Apache crashes, newly created PHP files, and unfamiliar administrator accounts. Credentials will be rotated if suspicious activity is identified.
These measures are designed to reduce exposure while the permanent upgrade is prepared. They do not eliminate the underlying vulnerabilities, making the PHP upgrade essential.
|
Action |
Purpose |
Status |
|
Request and memory controls |
Reduce exposure to oversized requests and excessive memory consumption |
Mitigations being applied |
|
Disable session upload progress |
Block the confirmed attack path associated with CVE-2026-109619 |
Mitigation being applied |
|
Apache and PHP configuration hardening |
Enforce request limits and review server settings |
In progress |
|
Security log and file review |
Identify suspicious requests, unexpected files, or unfamiliar administrator accounts |
Ongoing review |
|
Migration to PHP 8.5.12 |
Permanently address both vulnerabilities |
Migration preparation started |
|
IP-based access restrictions |
Limit access to approved office or VPN IP addresses |
Contact the uKnowva team |
|
On-premises deployment guidance |
Review infrastructure-specific security and upgrade requirements |
Contact the uKnowva team |
Our Permanent Fix: Migration to PHP 8.5.12
The uKnowva team has already started preparing the migration to PHP 8.5.12, which includes fixes for both vulnerabilities.
The planned migration involves:
-
Checking compatibility of the uKnowva codebase with PHP 8.5.12.
-
Testing essential workflows, including login and SSO, leave and attendance, payroll and payslips, workflows, document uploads, Excel and PDF exports, API integrations, and cron jobs.
-
Rolling out the upgrade to production with a short rollback window.
-
Retaining relevant security hardening measures after the upgrade.
A detailed migration timeline will be shared in the coming week.
Additional Security Measures for uKnowva Customers
Alongside our server-level mitigations and planned PHP upgrade, customers can take additional steps to strengthen access security and deployment protection.
1. IP-Based Access Restrictions
If your organisation accesses uKnowva HRMS through fixed office IP addresses or a VPN, restricting access to approved IP addresses can significantly reduce exposure to external threats.
Want to enable IP restrictions for your organisation? Simply connect with the uKnowva team. We will help you explore the appropriate implementation for your deployment.
2. Dedicated Guidance for On-Premises Deployments
Organisations running uKnowva HRMS on their own infrastructure may require deployment-specific security measures, depending on their server configuration, PHP version, and network access policies.
If you operate an on-premises deployment, connect with the uKnowva team for guidance on reviewing your infrastructure and planning the appropriate mitigation and upgrade approach.
3. Review Your Access and Security Controls
As an additional precaution, organisations should review administrator access, network exposure, server logs, and existing security controls. Ensure that only authorised users and systems can access administrative interfaces, and investigate any unusual server activity promptly.
Our Commitment to Security
Security is an ongoing responsibility, and we are addressing these PHP vulnerabilities through immediate risk-reduction measures, infrastructure hardening, and a planned upgrade to a fixed PHP release.
We recommend that customers who can restrict access to approved IP addresses consider enabling this protection, while organisations with on-premises deployments should connect with our team to discuss their specific requirements.
For assistance with IP restrictions, on-premises infrastructure, or any questions regarding this security advisory, please contact the uKnowva team.
We remain committed to protecting your organisation's HR data and maintaining a secure, reliable uKnowva HRMS experience.
If you have any questions or need additional support, feel free to contact us at This email address is being protected from spambots. You need JavaScript enabled to view it..