Regarding PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

We were informed about two vulerabilities which were just disclosed in PHP. Both of them are related to PHP session upload progress, and our products WebMail Pro and Aurora Corporate do not use this functionality of PHP.

Still, to lower the potential security risks, we recommend setting the following option in your php.ini file (uncomment the line if it's commented out):

session.upload_progress.enabled = Off

Additionally, apply the following configuration change:

session.use_strict_mode = 1

Upon making changes, be sure to restart the webserver and PHP-FPM if you use it.

Again, this will in no way affect the behavior and performance of our products.

And since PHP maintainers already released security update that fixes PHP itself, it's best to update PHP on your server as soon as possible. Please note that we strongly recommend running PHP 8.3 or newer, and the latest version of WebMail/Aurora, to ensure you have the latest security patches and compatibility with the up-to-date PHP version. Please contact us if you have questions regarding an upgrade.