The PHP project has reserved CVE-2026-115560 for a third remote code execution issue in PHP, published as an informational advisory on 23 October 2026. The PHP fix has not yet been released; it is scheduled for the next regular bugfix release rather than an emergency one.
Exploitation requires an application that sets session.serialize_handler to php_binary or php_serialize, then changes it at runtime with ini_set() before session_start(), with session upload progress enabled. [State the SvKMS position, e.g.: “The SvKMS web application does not change the session serialization handler at runtime and does not enable session upload progress, and is therefore not affected.”]
The exposure status in the table below is unchanged. StorMagic will update this article when the PHP fix is released and reassessment is complete.
Summary
StorMagic has completed an assessment of its product portfolio against two publicly disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The assessment covered every StorMagic product for the presence of an embedded PHP runtime and, where present, whether the affected code path is reachable. A third issue reserved as CVE-2026-115560 is addressed in the update above.
Of the StorMagic products assessed, only SvKMS includes a PHP runtime. SvSAN, SvHCI, Edge Control Cloud, and Edge Control (on-premises) do not include PHP and are therefore not affected. No action is required for customers running those products.
At a glance
Four products not affected, no action required. One product (SvKMS) affected, upgrade required.
Product exposure
| Product | PHP runtime included | Exposure status | Customer action |
|---|---|---|---|
| SvSAN | No | Not affected | None |
| SvHCI | No | Not affected | None |
| Edge Control Cloud | No | Not affected | None |
| Edge Control (on-premises) | No | Not affected | None |
| SvKMS | Yes | Affected | Apply remediation below |
For products marked not affected, this conclusion reflects the absence of a PHP runtime in the shipped software. No configuration change, workaround, or upgrade is required to address these CVEs.
For SvKMS, the bundled PHP runtime is affected by both CVEs. Under specific conditions, an attacker could [describe the reachable impact, e.g. “execute code on the SvKMS appliance with the privileges of the web service and access key material used to encrypt protected systems”]. Exploitation requires network access to the management interface; no credentials are required [revise if your assessment differs].
SvKMS remediation
Action required for SvKMS
Upgrade to SvKMS 2.6.6 or later. Customers who cannot upgrade immediately should apply the interim mitigation described below.
- Fixed version: SvKMS 2.6.6 and later, released 26 October 2026.
- Recommended action: Upgrade at the earliest opportunity. Upgrades are performed per the SvKMS upgrade KB.
- Interim mitigation: If an upgrade cannot be scheduled immediately, restrict management-interface access to trusted networks.
- Verification: After upgrading, confirm the installed SvKMS version is 2.6.6 or later.
- References: [NVD — CVE-2026-109618], [NVD — CVE-2026-109619], [PHP release announcement, 21 October 2026], [StorMagic security advisory page].
Scope notes
This advisory applies to PHP as shipped within StorMagic products only. PHP running inside customer-deployed workloads, virtual machines, or containers hosted on SvSAN or SvHCI is outside the scope of this assessment and should be patched by the customer in line with their own vulnerability management process.
Customers who require further assistance should raise a case with StorMagic Support, quoting advisory reference [reference ID].
Revision history
| Date | Change |
|---|---|
| 27 Oct 2026, 09:00 | Initial publication: product exposure assessment, SvKMS 2.6.6 remediation. |
| 27 Oct 2026, 10:00 | Added CVE-2026-115560 update; no change to exposure status. |
Comments
0 comments
Article is closed for comments.