====== Security Incident Report - PHP Remote Code Execution Vulnerabilities ======

===== Overview =====

On 21 October 2026 the PHP project published a security advisory covering two critical vulnerabilities in the PHP runtime, informally referred to as "PHP2Shell". Both allow unauthenticated remote code execution against any PHP installation serving web requests, including PHP-FPM, which the Lime cloud services listed below run on.

**Severity:** Critical (CVSS 4.0 base score 9.2)

**Status:** Resolved, all systems patched

**Evidence of exploitation:** None observed

**Environment:** Lime cloud services

**Affected products:** Lime Forms, Lime Portals, Lime Signatures, Lime BankID, PDF Manager, FF Portals

Lime became aware of the vulnerabilities through early industry reports ahead of the official release. We applied the available mitigations in the morning and monitored traffic throughout the day. Ahead of the public release of the vulnerability details we took the affected services offline as a precaution, patched every server as soon as fixed packages were available, and restored service. Services were back within approximately one hour. No evidence of exploitation was found and no customer data was affected.

===== Vulnerability Details =====

==== What is affected? ====

  * All PHP versions prior to 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are vulnerable, as are all end-of-life branches.
  * The vulnerability is in the PHP runtime itself, not in Lime application code, so every PHP-based Lime cloud service was potentially exposed.

==== What is the risk? ====

  * **CVE-2026-109618, RCE via out-of-memory corruption.** A request that drives a PHP worker out of memory can interrupt PHP while internal request data is partially initialised. Cleanup code may then act on invalid data.
  * **CVE-2026-109619, RCE via stale global state.** Request-owned internal state can survive after its memory has been freed. A later request handled by the same worker may reuse that stale state before normal initialisation resets it. The confirmed attack path uses PHP's session upload progress feature together with a multipart file upload.

Both issues can be triggered by an unauthenticated request before any application code runs. Successful exploitation gives an attacker code execution with the permissions of the web server user.

==== Who discovered this? ====

The vulnerabilities were reported to the PHP security team and disclosed with coordinated patches on 21 October 2026. Active exploitation attempts were reported publicly before the release. Lime observed none against its own infrastructure.

These issues are tracked as [[https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w|CVE-2026-109618]] and [[https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp|CVE-2026-109619]]. See the [[https://www.php.net/archive/2026.php#2026-10-21-5|php.net security advisory]] for details.

===== Lime's Response =====

All times are CEST on 21 October 2026.

^ Time ^ Action ^
| 07:00 | Interim mitigation applied on all servers running PHP, reducing exposure to CVE-2026-109619 ahead of the official patch. Continuous review of web server access logs began. |
| 07:00 to 15:45 | Access logs from all servers running PHP reviewed for the published indicators of compromise and for anomalous upload traffic. No indicators found. |
| 12:00 | Extended request logging deployed on all servers to allow exploitation attempts to be identified directly. Review continued on the new logs. |
| 15:45 | All affected services taken offline as a precaution ahead of the public release of the vulnerability details, so that no request could reach an unpatched server. Patching began as soon as fixed packages were available. |
| 15:45 to 16:45 | PHP upgraded on all servers to patched releases and every PHP-FPM worker restarted. |
| 16:45 | Updated servers brought back online in stages. |
| 17:10 | All services online and operational. |

==== Versions deployed ====

^ Branch ^ Patched version ^
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |

Services on older branches, which no longer receive updates from the PHP project, received minimal source backports provided by the PHP security team and built by our package vendor on the same day. These were applied in the same window. Those branches are scheduled for retirement independently of this incident.

==== Evidence of exploitation ====

Access logs from all servers running PHP for 21 October were reviewed for the published indicators of compromise and for anomalous request patterns. None were found. Routine automated scanning unrelated to this vulnerability was observed and rejected by the web server, as on any public system. We have no evidence that any Lime system was accessed or that any customer data was exposed.

===== Customer Impact =====

  * The services listed above were unavailable on 21 October 2026 between 15:45 and 17:10 CEST, most of them for approximately one hour.
  * Embedded forms did not load during this window, and portals, signing, BankID and PDF services were unreachable. Visitors could not submit forms, sign documents or complete BankID flows.
  * No submissions, documents or data were lost. Requests made during the outage were not accepted, so there is no partial or corrupted data.
  * No customer action is required.

===== Recommendations =====

  - **No action is required for Lime cloud customers.** All services are patched and running.
  - **Customers running Lime products on their own infrastructure**, such as on-premise Lime Forms installations, should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately.
  - If you observed form submission failures between 15:45 and 17:10 CEST on 21 October, ask the visitor to resubmit. The data was not received.
  - Contact Lime support if you have questions about this incident.