This hotfix is to address two very serious vulnerabilities (CVE-2026-109618 and CVE-2026-109619) found in PHP technology which is used in our MDM back-end.
The update of Techstep Essentials MDM to version 5.42.3 has been released and already contains a fix for the above security problems.The official PHP update should arrive separately.
We highly recommend that you update to the latest version of the software as soon as possible.
In case the upgrade cannot be made at the moment in your environment, the security problems could be addressed by making a slight configuration adjustment.
Here are the required steps:
# check current settings:
[root]# php -r 'phpinfo();' | grep 'session.upload_progress.enabled'
session.upload_progress.enabled => On => On
# change PHP configuration
[root]# echo "session.upload_progress.enabled = Off" > /etc/php.d/99-harden-session.ini
# check if the change is applied - "Off" value is correct one
[root]# php -r 'phpinfo();' | grep 'session.upload_progress.enabled'
session.upload_progress.enabled => Off => Off
# Restart php-fpm
[root]# systemctl restart php-fpm
For more details, see the following [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-20-1).