Status — 22 October 2026: fix in progress. Replacement KohaSupport AMIs are being prepared and are not yet published to AWS Marketplace. Existing servers should be checked and updated promptly.
AWS and the PHP project have disclosed two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Crafted requests reaching an affected PHP runtime can allow unauthenticated remote code execution.
Although Koha uses Perl, servers may also have PHP components installed. Check the installed PHP packages and update affected components. The presence of PHP packages alone does not establish that a server exposes a vulnerable PHP endpoint or has been compromised.
What existing customers should do
Update PHP on your running server; do not wait for a replacement AMI. Publishing a new image does not update existing servers.
For Ubuntu 26.04 with PHP 8.5, take a current backup, then run the following through AWS Systems Manager Session Manager or your normal administrative connection. Restarting Apache briefly interrupts web requests.
sudo apt-get update
sudo apt-get install --only-upgrade \
libapache2-mod-php8.5 php8.5 php8.5-cli php8.5-common \
php8.5-mysql php8.5-readline
sudo apache2ctl configtest && sudo systemctl restart apache2
dpkg-query -W -f='${Package} ${Version}\n' \
libapache2-mod-php8.5 php8.5-common php8.5-cli
sudo systemctl is-active apache2
All three reported PHP packages must be 8.5.4-0ubuntu1.5 or later, and Apache must report active. Afterward, check your public catalogue and staff interface. If a command fails, Apache does not restart, or packages remain below the fixed version, contact KohaSupport.
apt-get update alone does not install the fix. It refreshes the package index. The installation command applies the updates, and restarting Apache loads the updated PHP module.
Ubuntu backports security fixes. PHP can still display version 8.5.4 after patching; check the full package revision rather than relying on php -v or the unversioned php metapackage.
Other Ubuntu and PHP versions
Ubuntu lists the following fixed package revisions for both vulnerabilities. These are vendor package versions, not a claim that every customer configuration has been tested by KohaSupport.
| Ubuntu release | PHP branch | Fixed Ubuntu package version |
|---|---|---|
| 26.04 LTS | 8.5 | 8.5.4-0ubuntu1.5 |
| 24.04 LTS | 8.3 | 8.3.6-0ubuntu0.24.04.13 |
| 22.04 LTS | 8.1 | 8.1.2-1ubuntu2.28 |
Do not copy the PHP 8.5 commands onto a server using another branch. If you use another Ubuntu release, multiple PHP versions, PHP-FPM, additional PHP extensions, or third-party repositories, contact support for the corresponding package and worker-restart checks.
Replacement images
We are updating the build pipeline to install current PHP packages explicitly and reject builds below the required security version. We are preparing replacement images for Free x86, Basic ARM64 and x86, Standard ARM64 and x86, and Enterprise ARM64.
The replacements are not yet published. No Marketplace availability date is being announced. Each image must pass package and runtime checks before release. Existing servers still need their own updates regardless of a future image release.