Security Advisory: JetBackup PHP Security Update Now Available — CVE-2026-109618 and CVE-2026-109619

[Starburst-David]

JetBackup 5 and JetBackup MC updates addressing CVE-2026-109618 and CVE-2026-109619 are now available. PHP announced these critical vulnerabilities on October 20, 2026, and released security fixes on October 21. Under certain conditions, they can allow an unauthenticated attacker to run code on an affected server. See PHP’s security advisory for details.

The JetBackup hotfixes are delivered automatically. You do not need to download packages or change your update channel.

• JetBackup 5 on CentOS 7: JetBackup 5.3.12.2 with bundled PHP 8.1.34.0

• JetBackup 5 on supported operating systems (ALPHA and EDGE): JetBackup 5.4.2.5 with bundled PHP 8.3.36.0

• JetBackup 5 on supported operating systems (RELEASE and RC): JetBackup 5.4.1.5 with bundled PHP 8.3.36.0

• JetBackup MC, all release tiers from ALPHA through RELEASE: version 1.1.14 with bundled PHP 8.1.34.0

Update Manually

If you prefer to apply the update immediately, run the following command as root on your server, regardless of which control panel you use:

Code: Select all

jetapps -a

Check your installed version:

Code: Select all

jetapps --list-installed

Find the jetbackup5 package in the output and compare its version with the applicable version above. An additional package build number after the JetBackup version is normal.