|
Component |
edoc 365 business process platform |
|---|---|
|
Version |
All versions |
|
Created on |
|
|
Last modified on |
No Workflow Applied |
|
Review status |
No Workflow Applied |
|
KB article number |
2727444676 |
Summary
On October 21, 2026, the PHP Project released details and security updates regarding two critical vulnerabilities. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution (RCE) on web servers running PHP applications under certain conditions. In general, PHP installations that process web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
This vulnerability is relevant to edoc because several of its components use PHP. We therefore classify our products as affected.
Monthly Release 2026/09.1, which includes the necessary fixes, is now available. It is scheduled to be released to the Quarterly Channel on 2026-10-23.
Additional information online:
-
BSI - Federal Office for Information Security - Version 1.0: PHP - Critical Vulnerabilities Threaten Web Applications Worldwide (currently available only in German)
As a precautionary measure, the affected systems of edoc365 customers will be secured against external access. As soon as the necessary security updates are available, edoc will install them, and the systems will then be restored to normal operation. The affected edoc365 customers will be notified separately regarding this matter.
To enable you to continue working during the current safety measures, you can have edoc temporarily grant access to the edoc 365 environment for a specified public IP address range. Please contact our support team and provide us with the required IP address range so that we can set up the access permission accordingly.
Updates to this article
|
Date and time |
Description |
|---|---|
|
2026-10-22, 4:50 p.m. |
|
|
2026-10-22, 4:20 p.m. |
|
|
2026-10-22, 11:20 a.m. |
|
|
2026-10-21, 6:50 p.m. |
|
|
2026-10-21, 5:00 p.m. |
|
|
2026-10-21, 2:00 p.m. |
|
|
2026-10-20 |
|
Current situation
The published information confirms two critical PHP vulnerabilities that allow remote code execution:
-
CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: A flaw in the out-of-memory handling may cause PHP to continue processing incompletely initialized internal request data during cleanup. Among other things, specially crafted multipart requests can cause memory usage to increase in a controlled manner.
-
CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: Internal global state from a previous request may persist in a worker after memory is freed and be reused by a subsequent request. This can lead to use-after-free, memory leaks, and remote code execution.
The fixed versions listed by the PHP Project are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Updating to a patched version of PHP is the only complete solution. Mitigation measures can reduce the risk but are not a substitute for the update.
Impact on edoc products
Several applications of the edoc business process platform and edoc agent components (edoc platform) use PHP technologies. Since the vulnerabilities affect PHP installations that process web requests, we assume that our system is affected and are working to secure or update the affected components.
Discontinued products (End of Life)
The two products that have already been discontinued— edoc document reader tester and app server v2—are also affected by these vulnerabilities.
Security updates are no longer provided for these components. We recommend that you completely uninstall these products as needed or as soon as possible to reduce potential security risks.
Recommended precautions
Until the fix is released and installed, we recommend that all customers restrict access to the edoc platform's web server as much as possible. In particular, access to HTTPS/Port 443 should be permitted only for necessary networks, user groups, or upstream security systems.
This measure reduces the attack surface for unauthenticated attacks from the Internet, but does not replace the installation of security updates. Please evaluate its implementation based on your infrastructure and business requirements.
Note for edoc365 customers
edoc365 systems are updated automatically. In addition, external access is currently restricted to minimize the attack surface until the update is complete. The web interface will not be available during this period. Background processes—such as the processing of incoming e-mails, as well as OCR and Document Intelligence processes—can generally continue to run.
Planned actions by edoc
Release Monthly 2026/09.1, which includes the necessary fixes, is now available. A hotfix for the Quarterly Channel is scheduled for release on 2026-10-23.
The fix will be included in the latest releases of the following release channels:
-
Monthly Channel
-
Quarterly Channel
We strongly recommend that you check now to see if you are using the latest version of your selected release channel. If you are using the latest versions, you can apply necessary security updates more quickly, thereby minimizing potential maintenance and downtime.
The fix was released with the Monthly 2026/09.1 release. Following that, we will release a hotfix for the Quarterly 2026/Q3.
On-premises customers will receive separate information about the options for updating.
Deployment of security updates
The updated Release Monthly 2026/09.1 is now available. We will notify you separately regarding the release of the Quarterly hotfix.
-
Customer systems with automatic updates enabled will receive the update automatically according to their update configuration.
-
For customer systems without automatic updates, the provided updates must be installed manually.
Note on the edoc agent
edoc agent runs on Ubuntu systems. The PHP version used there is provided via the operating system’s package manager. On systems with security updates enabled—for example, via unattended-upgrades—the corresponding PHP security updates are typically installed automatically by the operating system as soon as they become available. The PHP installation on the edoc platform itself is not affected, as the platform does not provide a web server but only offers CLI access.
Please update the server with edoc platform (edoc agent) as soon as possible. This will ensure that the latest, patched version of phpMyAdmin is downloaded during the next synchronization process (Sync), since phpMyAdmin was also affected by the vulnerability.
Current status
-
Monthly Release 2026/09.1, which includes the necessary fixes, is now available. The hotfix for the Quarterly Channel is scheduled for tomorrow.
-
Details and security updates regarding two critical PHP vulnerabilities have been released.
-
PHP installations that process web requests are affected. edoc uses PHP and therefore classifies the affected components as affected.
-
Under certain conditions, these vulnerabilities could allow unauthenticated remote code execution.
-
Until the fix is released, we strongly recommend limiting access to the edoc platform's web server (port 443) as much as possible.
-
edoc365 customers will be automatically updated. External access to the systems is currently restricted.
We will continue to monitor the situation closely and will keep you informed as soon as reliable information or updated versions become available.