[pmwiki-users] PmWiki.org temporarily offline following critical PHP security vulnerabilities

[Petko Yotov]

Hello everyone,

TL;DR: PmWiki.org is temporarily offline, but we have backups, several 
options for restoring the website, and ways to access the content in the 
meantime. I am also available to help anyone who needs assistance with 
their PmWiki installation.

WHAT HAPPENED?

Last Wednesday, two critical vulnerabilities known as PHP2Shell were 
disclosed and patched in PHP. They can allow remote attackers to execute 
commands on a server without authentication, potentially gaining access 
to the server itself. The vulnerabilities affect PHP, not PmWiki 
specifically, and can impact any website running an affected PHP 
installation.

The recommended response is to upgrade to a fixed PHP version 
immediately or take the affected PHP installation offline until it can 
be secured.

At 18:00 Paris time (12:00 New York time), I contacted Pm about the 
situation. An hour later, I also sent a message to the PmWiki Users and 
Notify mailing lists, explaining the urgency and the need to address the 
vulnerabilities.

I have immediately upgraded the servers I manage and checked that the 
shared hosting plans I monitor were also up to date.

The situation on PmWiki.org is different because I manage the website 
itself, but not the underlying server, and I do not have the access 
needed to upgrade PHP or the operating system.

Pm responded quickly, and I understand that he has a lot on his plate at 
the moment. The server's operating system and PHP installations are 
quite old, so upgrading PHP may require a broader server upgrade, a 
reinstall, or a migration to a new server. On top of that, the hosting 
provider experienced an outage affecting its administration panel for 
several hours on Thursday and Friday, making it impossible to 
investigate the available options during that time.

In the meantime, Pm made a full backup of the PmWiki home directory.

WHAT I HAVE DONE IN THE MEANTIME

There was also a separate issue: Subversion, our code repository, had 
stopped working a few days earlier, and I could not access it. Pm 
restarted the service, allowing me to commit the core changes I had 
pending.

I then released PmWiki 2.7.7 and, after Holger reported a bug, 2.7.8. 
These releases are unrelated to the PHP security vulnerabilities.

Given the security risk and the fact that I could not upgrade PHP 
myself, I notified Pm that I disabled PHP execution on the PmWiki.org 
website and replace the dynamic pages with a static HTML page. This is 
the page you currently see when visiting the site.

The static page provides access to:

	*

The latest PmWiki downloads, release notes, and change log.
	*

All uploaded Cookbook recipes and skins.
	*

The Internet Archive's Wayback Machine, with a direct link to the 
archived version of the corresponding page, where a recent cached copy 
may be available.

The latest English documentation is also included in the PmWiki 
distribution archives, which can be downloaded from the static page.

WHAT IS STILL AVAILABLE?

Although the website is temporarily unavailable as a dynamic wiki, the 
following services and resources remain available:

	*

Subversion, which is normally working again.
	*

The PmWiki mailing lists.
	*

PmWiki core releases, Cookbook recipes, and skins, available for 
download from the static page.
	*

Archived versions of individual pages through the Internet Archive.

Both Pm and I have backups of the PmWiki home directory and 
installation, so we have copies of the content available while we work 
out the next steps.

WHAT ARE OUR OPTIONS FOR RESTORING PMWIKI.ORG?

The first option is to upgrade the existing server, provided that this 
can be done safely and within a reasonable timeframe. Depending on the 
server's operating system and configuration, this might require a more 
extensive upgrade or migration.

I have also prepared an alternative: I installed a copy of the 
PmWiki.org content on one of my hosting plans, under a different domain 
name.

The copy mostly works, but moving from PHP 7.0 to PHP 8.4 is not 
straightforward. New PHP versions introduce changes that can cause older 
scripts to produce warnings or errors, or to stop working altogether. I 
continuously test and update the PmWiki core to support recent stable 
PHP versions, but individual Cookbook recipes, skins, and local 
configurations may also need attention.

To make this alternative viable, I would need to review the pages, 
particularly those in Cookbook, Skins, and Test, identify the problems, 
and update or disable the affected recipes and configurations as 
appropriate. If we decide to proceed with this option, I will ask for 
help identifying and testing the pages that need attention.

If we use the alternative installation, we could configure PmWiki.org to 
redirect visitors to the corresponding paths on the new domain. This 
could be a temporary arrangement while the original server is upgraded 
or migrated.

Once the original website is ready again, we could synchronize any 
changes made on the alternative installation back to the original one 
and redirect visitors back to PmWiki.org.

This would involve a considerable amount of work, so if Pm can upgrade 
the existing server in a reasonable timeframe, I would be happy to wait 
and help with the transition back to normal service. Otherwise, the 
alternative installation gives us another way forward.

For now, we are waiting for Pm to have time to assess the situation and 
decide how best to proceed. I am happy to help with either option.

WHAT ABOUT YOUR OWN PMWIKI INSTALLATION?

If you run PmWiki on your own server or hosting plan, please check your 
PHP installation as soon as possible.

The PHP releases that fix these vulnerabilities are:

	*

PHP 8.2.35
	*

PHP 8.3.36
	*

PHP 8.4.27
	*

PHP 8.5.12

Later releases in these branches also contain the fixes. If you are 
running an older PHP version, check whether your operating system or 
hosting provider has supplied a patched package. Some vendors backport 
security fixes to older versions, so the version number alone may not 
tell the whole story.

If your installation cannot be patched immediately, take the affected 
PHP service offline until you can secure it. Another possible interim 
measure is to use a web application firewall. Cloudflare has been 
reported as offering mitigation for this vulnerability, but such 
protection is not a substitute for applying the appropriate PHP security 
fixes. Using its proxy service also requires routing your DNS traffic 
through Cloudflare.

The vulnerabilities affect PHP itself, before the application code is 
processed. Consequently, changing PmWiki scripts or disabling a 
particular PmWiki feature is not a reliable way to fix them.

If an attacker exploits a vulnerable installation, the consequences may 
extend well beyond the wiki. Depending on the server's configuration and 
privileges, an attacker may be able to read page content, page 
histories, metadata, deleted pages, uploads, scripts, configuration 
files, and secrets stored on the server. They may also be able to modify 
the website, distribute malware, or access credentials that could be 
reused elsewhere.

This is why I strongly recommend upgrading to a patched PHP version, 
even if doing so exposes compatibility problems with older recipes or 
local customizations. Those problems can generally be investigated and 
addressed; leaving a server vulnerable to remote code execution is a 
much greater risk.

For more technical information, see the PHP security advisory and the 
relevant vendor guidance.

HOW I CAN HELP

If your PmWiki installation needs attention, please feel free to contact 
me.

I am available to help with upgrading older PmWiki installations, 
resolving PHP compatibility warnings and errors, updating Cookbook 
recipes and local customizations, and migrating wikis to a more recent 
PHP version or a different hosting plan.

If you have been putting off an upgrade because your wiki has 
accumulated years of customizations, we can work through the issues 
together and find a practical way to get it up to date and back online.

Thank you for your patience while we work through this situation, and 
thanks to Pm, to everyone who contacted me privately, and to everyone 
who helps maintain and support the PmWiki community.

Best regards,
Petko

On 21/10/2026 19:06, Petko Yotov wrote:

> Hello everyone,
> 
> Today the PHP development team has announced two critical remote code 
> execution (RCE) vulnerabilities affecting PHP. An attacker may be able 
> to execute arbitrary code on a vulnerable server without 
> authentication.
> 
> These vulnerabilities affect PHP itself, not just any particular web 
> application, and not just PmWiki. PmWiki administrators and webmasters 
> should check every server running PHP, including systems hosting 
> multiple websites.
> 
> Vulnerabilities:
> * CVE-2026-109618: https://www.cve.org/CVERecord?id=CVE-2026-109618
> * CVE-2026-109619: https://www.cve.org/CVERecord?id=CVE-2026-109619
> 
> The vulnerabilities affect all PHP versions from PHP 5 onwards, 
> including:
> * All PHP 5.x and 6.x versions
> * All PHP 7.x versions, including PHP 7.0
> * PHP 8.0 and 8.1, all versions
> * PHP 8.2 before 8.2.35
> * PHP 8.3 before 8.3.36
> * PHP 8.4 before 8.4.27
> * PHP 8.5 before 8.5.12
> 
> Official security announcement:
> https://www.php.net/archive/2026.php
> 
> The PHP project has released fixes for PHP 8.2.35, 8.3.36, 8.4.27 and 
> 8.5.12. Some vendors also provide backported fixes for older branches, 
> including PHP 7.4, 8.0 and 8.1.
> 
> What you should do:
> 
> Check which PHP version your web server actually uses. Remember that 
> the command-line PHP version may differ from the version used by Apache 
> or PHP-FPM.
> 
> Update immediately to a fixed release, or install the security-patched 
> package supplied by your Linux distribution or hosting provider.
> 
> If you are running an obsolete PHP branch such as PHP 7.0, do not 
> assume it is safe. Upgrade to a currently supported PHP version, or 
> confirm with your vendor that a security fix has been applied.
> 
> If you cannot patch an affected server immediately, consider isolating 
> it from public access until it can be secured.
> 
> Further information in English:
> 
> PHP security announcement:
> https://www.php.net/archive/2026.php#2026-10-21-2
> 
> PHP advisory for CVE-2026-109618:
> https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
> 
> PHP advisory for CVE-2026-109619:
> https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
> 
> CERT-EU security advisory:
> https://cert.europa.eu/publications/security-advisories/2026-018/
> 
> Please do not assume that a PmWiki installation is safe simply because 
> it is up to date. These vulnerabilities are in the underlying PHP 
> runtime, so updating PmWiki alone will not fix them.
> 
> Please check your servers and apply the appropriate security updates as 
> soon as possible.
> 
> Petko
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.pmichaud.com/pipermail/pmwiki-users/attachments/20261028/b4d3c5bf/attachment-0001.html>