#1151516 Critical vulns in PHP (CVE-2026-109618 and 109619)

Package:
php8.4
Source:
php8.4
Submitter:
Raphaël MELIOR
Date:
2026-10-22 14:19:03 UTC
Severity:
normal
Tags:
#1151516#5
Date:
2026-10-21 09:47:30 UTC
From:
To:
Dear Maintainer,

It seems the CVE-2026-109618 and CVE-2026-109619 is not tracked :
https://security-tracker.debian.org/tracker/CVE-2026-109618
https://security-tracker.debian.org/tracker/CVE-2026-109619

Says :
Not found
Your query CVE-2026-109618 matched no results.

Both are critical vulnerabilities announced by PHP :
https://www.php.net/archive/2026.php#2026-10-20-1

Thanks,
#1151516#10
Date:
2026-10-21 14:05:59 UTC
From:
To:
The patched versions are now available on the PHP website;

https://www.php.net/archive/2026.php#2026-10-21-5
#1151516#15
Date:
2026-10-21 14:28:41 UTC
From:
To:
php 8.4.27 seems to be available in security already

https://security.debian.org/debian-security/pool/updates/main/p/php8.4/
#1151516#30
Date:
2026-10-21 15:59:37 UTC
From:
To:
Dear Maintainer,

after installing all php updates to 8.4.27-1~deb13u1 no php website does work. PHP reports errors for all php modules:

php_errors.log:[21-Oct-2026 15:50:13 Europe/Berlin] PHP Warning:  PHP Startup: Unable to load dynamic library 'mysqli.so' (tried: /usr/lib/php/20240924/mysqli.so (/usr/lib/php/20240924/mysqli.so: undefined symbol: mysqlnd_global_stats), /usr/lib/php/20240924/mysqli.so.so (/usr/lib/php/20240924/mysqli.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0

Before installing the updates all webpages does run correctly. Update installed with apt update && apt upgrade. The modules does exist.

All updates are installed, no further updates available.

Thanks for your support.
#1151516#41
Date:
2026-10-22 08:51:48 UTC
From:
To:
Hello

I also have problems after the security upgrade to 8.4.27-1~deb13u1.
The connection to the database (mariadb) was not working.
After restart of apache2 it works again - for now.

This happened on two servers.

Just after the php-upgrade it did work at first.

I think it stopped working at the time the log rotation was performed,
but not sure.


Jochen
#1151516#46
Date:
2026-10-22 12:38:04 UTC
From:
To:
Hi,

I am 99% sure this is your local configuration problem that you mangled the priorities of the modules in /etc/php

Ondrej
--
Ondřej Surý (He/Him)
ondrej@sury.org

A gentle nudge is always appreciated if I take a little longer to reply.
#1151516#51
Date:
2026-10-22 13:55:40 UTC
From:
To:
Hi,

I had the same error, an restart of apache didn't fix it. However,
stopping and starting apache fixed the error.

Regards,
Andi