Gateway: October 2026 PHP security vulnerabilities and temporary mitigation
Updated 2 minutes ago
by
admin
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow an unauthenticated attacker to execute malicious code on an affected server, potentially compromising its data and services.
The Gateway is an internal appliance, not a public web server. Provided its administration ports are not exposed to the internet, exposure is limited to devices with access to the local network or connected private networks. This reduces the risk compared with an internet-facing web server, but a compromised internal device could still attempt an attack.
The Ubuntu 22.04-based Gateway uses PHP 8.1, which is affected. Customers running an older Gateway version should upgrade ASAP.
LATEST 10:50: Ubuntu have published guidance on a backport fix https://ubuntu.com/blog/php2shell-vulnerability-fixes-available which resolves the vulnerability.
The steps are to log in to the CLI and run:
sudo apt update && sudo apt upgrade
Follow the prompts by accepting the defaults including when the red screens appear about Kernel upgrade and service restart.
When complete, running php -v should show PHP 8.1.2-1ubuntu2.28 which is the backported fix according to the article above.
Reboot the gateway to ensure all services restart.
Temporary Mitigation
We advise you to use the Ubuntu advice in the article above.
Until the update is available, use one of the following options to restrict access to the Gateway API and web administration interface on TCP ports 80 and 443.
These restrictions affect local web administration only. The underlying proxy functionality continues to operate. SSH access is unaffected.
Option 1: Restrict access to an authorised IP
Replace 10.0.0.111 with the administrator’s source IP as seen by the Gateway.
Apply:
sudo iptables -I INPUT 1 -p tcp -m multiport --dports 80,443 ! -s 10.0.0.111/32 -j DROP
Remove:
sudo iptables -D INPUT -p tcp -m multiport --dports 80,443 ! -s 10.0.0.111/32 -j DROP
Option 2: Block web administration entirely
Apply:
sudo iptables -I INPUT 1 -p tcp -m multiport --dports 80,443 -j DROP
Remove:
sudo iptables -D INPUT -p tcp -m multiport --dports 80,443 -j DROP
IPv6
If IPv6 is used (it is not by default), also block access over IPv6 when using either option above:
sudo ip6tables -I INPUT 1 -p tcp -m multiport --dports 80,443 -j DROP
To remove:
sudo ip6tables -D INPUT -p tcp -m multiport --dports 80,443 -j DROP
Run each selected apply command once. These rules take effect immediately.
Access restrictions are a temporary mitigation; install the Gateway update when available.