Errata - 6.0.4 - PHP CVEs

With the recent PHP CVEs released (CVE-2026-109618 & CVE-2026-109619), here’s a short update.

The Open-AudIT code itself is not affected, but you must upgrade your PHP to be safe.

Basically, Linux users should update the system software as normal - yum, apt, whatever. As long as you’re using a distribution that is still in its support window, you’ll be fine. The distributions already have patched versions of PHP.

Windows users will need to upgrade Open-AudIT to 6.0.5 with a patched PHP. We are preparing that release now with utmost importance. In the meantime, if Windows users are so concerned (and I don’t blame them if they are), you can stop the Apache service until you have updated to 6.0.5.

Our 6.0.5 release will be Windows only, will contain an updated PHP (and Apache and MariaDB) with some minor application patches that have since been committed.

The actual application code of Open-AudIT has no effect on this issue. The condition occurs in the PHP interpreter before any application code is executed. Hence - nothing we do “in-app” will matter. You must upgrade your PHP to be safe.