Today I did a bunch of updates to the forum, the server, and more specifically php. You may have heard about a very severe php exploit that was announced today under CVE-2026-109618 & CVE-2026-109619 also known as "PHP2Shell".
cloud.google.com
As of an hour ago or so I've updated many components of our forum to get us to php 8.3.36 which contains the fixes to address the two major CVE issues. The updates here escalated a few issues which required a major base Ubuntu Server OS update, a XenForo software update, and a few other updates to be able to get the newer fixed version of PHP installed to protect the site.
This means the forum software jumped many revisions and could have new changes, features, and behavior I wasn't prepared to slow-roll out and troubleshoot. This had to be done in order to support newer PHP versions regardless of the patched 8.3.36 we're currently running. If you encounter issues or strange behavior let me know here so I can start looking into it and resolve issues you find. Maybe if we're lucky you all get new features and better forum behavior due to upgrading the software.
Code:
Key takeaways
CVE-2026-109618 & CVE-2026-109619 (known as "php2shell") are reported Remote Code Execution vulnerabilities in PHP that could let attackers run their own code on affected servers.
* Both vulnerabilities reportedly affects every PHP version from PHP 5 onward, though no vendor advisory has confirmed this yet.
* No fixed version exists yet, so security teams should watch for an official announcement before taking action.
* Organizations running PHP in production should prepare to update quickly once an official fix is released.Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 | Google Cloud Blog
Follow these recommendations to minimize remote code execution risks in PHP from two critical vulnerabilities in the core PHP language runtime.
As of an hour ago or so I've updated many components of our forum to get us to php 8.3.36 which contains the fixes to address the two major CVE issues. The updates here escalated a few issues which required a major base Ubuntu Server OS update, a XenForo software update, and a few other updates to be able to get the newer fixed version of PHP installed to protect the site.
This means the forum software jumped many revisions and could have new changes, features, and behavior I wasn't prepared to slow-roll out and troubleshoot. This had to be done in order to support newer PHP versions regardless of the patched 8.3.36 we're currently running. If you encounter issues or strange behavior let me know here so I can start looking into it and resolve issues you find. Maybe if we're lucky you all get new features and better forum behavior due to upgrading the software.
