Provider security patch

21. October 2026

⚠️ Critical PHP vulnerability! Due to our current knowledge, there is a new PHP vulnerability, affecting all PHP driven applications worldwide. All PHP versions from 5.x until the most recent ones are affected (CVE-2026-109618 & CVE-2026-109619).

There are currently no php fixes available yet (21. October 2026 / 16:30).

IMPORTANT:

Details of this vulnerability have not yet been fully disclosed. Additional vulnerabilities or fixes may be published within the next hours or days.

We are monitoring the situation closely and will release the provider 6.0.2 update – based on the patched PHP versions – as soon as the full patches are available.

At the moment, there is no information available regarding how to find if the vulnerability was already abused on a system.

Due to our knowledge, one of the not yet published vulnerabilities affects the processing of POST messages in PHP. The only solution is patching PHP or disabling the affected feature. The regify system does not need and utilize this PHP feature, so it can get turned off without any drawbacks.

Please follow the below instructions, regarding your current provider version. These settings will reduce vulnerability, but will not finally fix it. But it is a good attempt to use this for a first protection, until we are able to release provider patch 6.0.2.

Provider 5.3

Log in to the regify appliance using SSH with root.

Execute the following lines:

echo -e '\nsession.upload_progress.enabled = Off' >> /etc/php.d/provider.ini
svc -t /service/*; systemctl restart httpd

From 17:00, also execute these lines:

echo -e '\nmax_input_nesting_level = 2' >> /etc/php.d/provider.ini
sed -i 's/^post_max_size\s*=.*/post_max_size = 15M/' /etc/php.d/provider.ini
sed -i 's/^memory_limit\s*=.*/memory_limit = -1/' /etc/php.d/provider.ini
svc -t /service/*; systemctl restart httpd

Depending on regibox enabled or not, it may trigger such warning:

svc: warning: unable to chdir to /service/*: file does not exist

This is fine and you can ignore it. It happens if regibox is ot activated on your system. But it is of no harm.

Now leave appliance session (eg CTRL+d).

IMPORTANT: There will be no final fix for provider 5! Please plan to upgrade to version 6 soon!

Provider 6.0.1

Log in to the regify appliance using SSH with root.

Execute the following lines:

echo 'session.upload_progress.enabled = Off' >> /etc/php/8.4/mods-available/provider.ini
providerConfig -o webRestart

From 17:00, also run these lines:

echo 'memory_limit = -1' >> /etc/php/8.4/mods-available/provider.ini
echo 'max_input_nesting_level = 2' >> /etc/php/8.4/mods-available/provider.ini
sed -i 's/^post_max_size\s*=.*/post_max_size = 15M/' /etc/php/8.4/mods-available/provider.ini
providerConfig -o webRestart

Leave appliance session.