PHP Vulnerability Question
-
Do the new PHP Vulnerabilities’ CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state) apply to FOG? And if so, will there be a patch?
-
@gleckey no patch would be necessary for FOG. The PHP vulnerability applies to PHP packages, not to fog.
Now, you can update the packages using your OS package management, or you can rerun the installer for FOG which also tries to update any of the packages FOG may need. Either option will work.
-
@Tom-Elliott I figured it was more-so on the internal end of things that we had to take care. But, wanted to make sure. Thank you for your response!
-
@Tom-Elliott Hi Tom
We have a Red Hat 8 server with FOG Project version 1.5.10.
The PHP version is 7.2.24.
We can upgrade this to the latest one without having issues with FOG console and registering, uni or multicast imaging?Thx!
-
@Dominique Running such an old version of PHP and FOG probably not a good thing.
While 1.5.10 worked on the 7.2 line I don’t recall if it accounted for 8.X versions of PHP, You’re willing to attempt it but I would still highly recommend updating to the latest for both the stable and php versions (and if you’re updating FOG may as well update to the rc-1.6.0 version as I plan on mid november timeframe to make it official and need feedback to ensure all is well.
Thank you!
-
@Tom-Elliott Thx for your reply.
We use FOG in a production environment. So I will hold for version 1.6.0 till GA
.
I will test the RC in a test environment.I will upgrade PHP on the Redhat server. Should I re-install FOG project with the original settings after upgrading PHP. Or isn’t that necessary?
-
@Dominique If you’re able to, I’d highly suggest to snapshot the server first, or otherwise ensure you have a path to reinstall php down to 7.2 just incase updating to 8.X breaks your 1.5.10 availability.
No, you shouldn’t need to re-install fog after updating PHP, but it also wouldn’t hurt anything (but again I highly recommend snapshotting if possible just due to the age of 1.5.10 vs the stable branch code base.)
