Dualog Cyber Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

Summary

Dualog has patched all affected services against two critical PHP vulnerabilities disclosed on 21 October 2026. Our cloud webmail services were updated promptly, and an in-depth review of our logs found no indication that the vulnerabilities were exploited against Dualog systems.

For vessels running Dualog ConnectionSuite, we have released version 5.14.002, which includes Business Mail with the patched PHP. We recommend that all customers upgrade at their earliest opportunity.

About the vulnerabilities

PHP is a widely used programming language that powers a large share of web applications, including the Roundcube webmail platform. On 21 October 2026, the PHP project released an emergency security update fixing two critical flaws, CVE-2026-109618 and CVE-2026-109619.

In plain terms, both flaws could allow an attacker on the internet to run their own code on an affected web server, without needing a username or password. A successful attack could give the attacker control of the server and access to the data it handles. Both flaws are rated 9.2 out of 10 on the industry-standard severity scale.

The flaws affect all common PHP versions in use today. Fixes were released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Security researchers observed attackers probing for vulnerable servers within hours of the release, so fast patching was essential.

Dualog Cloud: webmail and crew mail

Both Dualog Cloud webmail services are patched and require no action from customers. The services are built on Roundcube, which runs on PHP:

• webmail.dualog.com: patched
• crew.dualog.com: patched

After patching, our security team carried out an in-depth analysis of server and access logs for both services, covering the period before and after the public disclosure. We found no indications that either vulnerability was exploited against Dualog systems, and no signs of unauthorised access to customer data. We continue to monitor both services closely.

Dualog ConnectionSuite 5.14.002

Dualog ConnectionSuite 5.14.002 is now available and includes Business Mail with the patched PHP version. The release closes both vulnerabilities for vessels running Business Mail on board.

The update can be installed in two ways:

• Over-the-air (OTA): available now through the standard ConnectionSuite update mechanism.
• Direct download: available now for manual installation.

Recommended actions

1. Dualog Cloud users (webmail and crew mail): no action required.
2. ConnectionSuite customers: upgrade all vessels to ConnectionSuite 5.14.002, via OTA or direct download, as soon as operationally possible.
3. Other PHP-based systems: review any other systems in your own environment that run PHP, and apply the vendor patches.

For questions about this advisory or help with the upgrade, please contact Dualog Support. Security concerns can be raised with the Dualog security team.

1. CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP
2. Patchstack: PHP vulnerable to critical RCE
3. Rescana: release timeline and php.net links