Skip to main content

Cascade Administration reference

CVE-2026-109618 and CVE-2026-109619 (PHP)

Not affected

Neither Cascade Cloud nor on-premise distributions of Cascade CMS are affected by CVE-2026-109618 or CVE-2026-109619. Cascade CMS doesn't include or run PHP. If PHP is installed on a web server your sites publish to, that server needs to be updated. See Checking your web servers. Assessed 10/21/2026.

What are CVE-2026-109618 and CVE-2026-109619?

In summary:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

  • RCE via OOM corruption, CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
  • RCE via stale global state, CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

PHP security advisory (October 21, 2026)

Is Cascade CMS affected?

No. Cascade CMS is a Java application that runs on Apache Tomcat. It doesn't include PHP and doesn't use it at any point, so neither vulnerability applies to the CMS itself. This is true for Cascade Cloud and for every on-premise version. No action is needed on your Cascade CMS instance.

Checking your web servers

Cascade CMS publishes files to the web servers you configure for each site. Whether those servers are exposed depends on what runs on them, not on Cascade.

A web server is exposed if PHP is installed and serving web requests. That can be true even when the pages Cascade publishes are plain HTML:

  • Your published pages use PHP. Some sites publish pages with a .php extension so the web server can process server-side includes or other PHP code. If yours do, the server runs PHP.
  • Other applications share the server. A blog, form handler, directory, or other PHP application on the same server exposes it, even if Cascade never publishes PHP.

Ask your IT or server team to check each server your sites publish to:

  1. Confirm whether PHP is installed and serving web requests.
  2. If it is, update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install the updated package from your Linux distribution or vendor.
  3. PHP 8.1 and older no longer receive updates from the PHP project. Contact your vendor about backported fixes, or upgrade to a supported version.

If your sites are hosted by a third party, contact your hosting provider to confirm they've updated PHP.

If you can't update right away, the PHP security advisory lists temporary measures. The PHP project notes that these reduce exposure but don't make an installation safe, so plan to update as soon as you can.