The PHP project’s fixed releases close the vulnerabilities described in our prior customer notices. patch_php_cve.sh and patch_appliance_php_cve.sh updates your installation to the patched container images.

How to get it

Download the latest release of the Ubersmith installer.

Release Ubersmith Installer v4.7.6 · TeamUbersmith/ubersmith_installer

The tool to patch your release is in the root directory of the download.

The file is named:

patch_php_cve.sh (Ubersmith)
patch_appliance_php_cve.sh (appliance)

What versions it covers

Any Ubersmith installation on one of these versions:

5.0.0   5.0.1   5.0.2   5.0.3
5.1.0   5.1.1   5.1.2   5.1.3   5.1.4
5.2.0   5.2.1   5.2.2   5.2.3
5.3.0

How it works

Your installer records your installed version and install directory in ~/.ubersmith_installer.ini when you first installed or last upgraded. The script reads that file to find both, then:

1. Looks up the correct patched image version for your installed version from a built-in table.
2. Confirms the patched images actually exist in the registry before touching anything.
3. Backs up your docker-compose.yml (adds a timestamped .bak copy alongside it).
4. Updates the image tag for the php, mail, cron, and rwhois services in docker-compose.yml.
5. Pulls the new images and recreates those four containers.

How to run it

From your Ubersmith installer directory:

./patch_php_cve.sh

or from your appliance installer directory:

./patch_appliance_php_cve.sh

If support has given you a specific release version to use (for example, ahead of this script’s built-in table being updated), override it with:

./patch_php_cve.sh -r r6

or

./patch_appliance_php_cve.sh -r r6

After running it

Check that the four services came back up:

docker compose ps

If you applied the interim session.upload_progress mitigation from the earlier email, you can now revert it:

cp conf/php/ubersmith.ini.bak conf/php/ubersmith.ini
docker compose restart php

If you also applied the optional pool-file changes (post_max_size, upload_max_filesize, memory_limit), those were made directly inside the running container and are discarded automatically when patch_php_cve.sh / patch_appliance_php_cve.sh recreates the php container – no separate revert needed for those.

If something goes wrong

The timestamped docker-compose.yml.bak-<timestamp> file the script creates has your prior image tags in it. Restore it and run “docker compose up -d –no-deps php mail cron rwhois” to roll back.

Please contact support@ubersmith.com with the script’s output if it exits with an error.

---

Previous migration instructions (only use if you’re unable to use the updated installer above)

The PHP project has released fixed versions to address CVE-2026-109618 and CVE-2026-109619. We are building and testing updated Ubersmith container images, and will publish update instructions to ubersmith.com as soon as they are available.

If you need to reduce exposure before those images are ready, the steps below can be applied to your installation. If you are unable to apply these changes, remove public access to your Ubersmith environment until the updated Ubersmith container images are available.

Please note that this is not a fix. It closes one confirmed attack path. Only updating to the patched images resolves both vulnerabilities. Please still plan to update.

This change requires a restart of your php container.

Step 1. Locate your Ubersmith directory (typically, /usr/local/ubersmith)

grep ubersmith_home ~/.ubersmith_installer.ini

Change to that directory.

Step 2. Back up your PHP configuration

cp conf/php/ubersmith.ini conf/php/ubersmith.ini.bak

Step 3. Add the mitigation

Add the following two lines to the end of conf/php/ubersmith.ini:

; CVE-2026-109619 - temporary mitigation, remove after updating
session.upload_progress.enabled = 0

Note the leading semicolon on the comment line.

Step 4. Restart the PHP container.

docker compose restart php

A reload is not sufficient.

Step 5. Confirm the change is active

docker compose exec -T php sh -c 'for d in /etc/php/*/fpm/conf.d; do PHP_INI_SCAN_DIR=$d php -r "var_dump(ini_get(\"session.upload_progress.enabled\"));"; done'

This should print:

string(1) "0"

If it prints “1”, the change has not been picked up. Confirm you edited the file shown by step 1 and that step 4 completed.

This setting is safe to leave in place. Ubersmith does not use PHP’s upload progress feature, so disabling it has no effect on normal operation.

Optional: the remaining two settings in the advisory

The advisory also recommends lowering post_max_size and setting memory_limit = -1. These two cannot be set in ubersmith.ini.

They can still be applied, by editing the pool file in the running container.

First, check whether your installation mounts the pool file from the host. Look in docker-compose.override.yml for a line ending in pool.d/zubersmith.conf. If one is present, edit that file on the host instead of inside the container.

php_admin_value[memory_limit] = -1
php_admin_value[upload_max_filesize] = 16M
php_admin_value[post_max_size] = 32M

Note that this change will NOT clear itself when you apply the patched image. You will need to revert it yourself afterwards. If no such line is present, which is the default, use the commands below.

(a) Lower the request size limits

docker compose exec -u root -T php sh -c "sed -i 's/^php_admin_value\[post_max_size\].*/php_admin_value[post_max_size] = 32M/; s/^php_admin_value\[upload_max_filesize\].*/php_admin_value[upload_max_filesize] = 16M/' /etc/php/*/fpm/pool.d/zubersmith.conf"

(b) Remove the PHP memory limit

docker compose exec -u root -T php sh -c "sed -i 's/^php_admin_value\[memory_limit\].*/php_admin_value[memory_limit] = -1/' /etc/php/*/fpm/pool.d/zubersmith.conf"

Then restart and confirm:

docker compose restart php
docker compose exec -T php sh -c 'grep -E "memory_limit|post_max_size|upload_max_filesize" /etc/php/*/fpm/pool.d/zubersmith.conf'

Confirm the file contents inside the container after the restart.

php_admin_value[memory_limit] = -1
php_admin_value[upload_max_filesize] = 16M
php_admin_value[post_max_size] = 32M

To revert

To undo the ubersmith.ini change:

cp conf/php/ubersmith.ini.bak conf/php/ubersmith.ini
docker compose restart php

If you also applied the optional pool changes, recreating the container restores the file that ships in the image:

docker compose up -d --force-recreate --no-deps php

Applying the patched image, once available, will also recreate the php container.

An update when the patched images are available will be posted to ubersmith.com.