You may have seen today’s PHP security advisory making the rounds. Here is what it means for SeaTable.
What happened
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 and referred to in the press as “PHP2Shell”.
Together they can allow unauthenticated remote code execution on any server that handles web requests with PHP. The PHP team considers the risk highest for Apache with mod_php, where an unauthenticated request can trigger the flaw before any application code runs.
SeaTable is not affected
SeaTable does not use PHP!
This applies to every edition: SeaTable Cloud, SeaTable Server and SeaTable Dedicated. PHP is not part of any SeaTable installation, so there is nothing you need to do on your SeaTable instance in response to this advisory, and no SeaTable update is required because of it.
Services we operate ourselves
We do use PHP for a small number of our own services, such as account registration and team administration. These are operated entirely by us and are not part of any SeaTable installation — no customer instance runs this code. All of them are either already running a patched PHP release or are being updated just now: the container images behind these services were rebuilt on PHP 8.4.27, one of the fixed versions, on the day the advisory was published.
What we recommend
If you run other PHP applications of your own, update them now to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project, although some distributions ship backports. If you cannot patch immediately, the php.net advisory (https://www.php.net/) lists interim mitigations and recommends restarting your workers afterwards.
If you have any questions about your own setup, just reply in this thread.
