ILIAS — Panopto Community https://community.panopto.com/ Thu, 22 Oct 2026 05:56:07 +0000 en ILIAS — Panopto Community Notification of PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) https://community.panopto.com/discussion/3004/notification-of-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619 Thu, 22 Oct 2026 00:01:40 +0000 Bug Reports James Golden 3004@/discussions Hello, we want to let you know about an advisory covering two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

What is the issue?

Both vulnerabilities are in the PHP engine itself and can allow remote code execution. The PHP project released fixed versions on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier have reached end of life and have not received a fix.

Panopto’s core platform is not built on PHP, and our security team has confirmed our hosted service is not affected.

How do I tell if this affects me?

The Panopto plugins for Moodle and ILIAS are written in PHP. They run on your own LMS server, not on Panopto’s servers, and Panopto does not supply the PHP version they run on. If you use either integration, your LMS server is potentially affected.

Other software and services connected to your Panopto site may also be running PHP. Please check with your vendors directly.

How do I mitigate the issue?

  1. Check which PHP version your LMS server and any other self-hosted systems run.
  2. Update to one of the fixed PHP versions listed above as soon as possible. If you are on PHP 8.1 or earlier, you will need to upgrade to a supported version.

Until you can patch, follow the advisory’s guidance, which is to limit public internet access to PHP-based applications.

If you have any questions, contact Panopto Support online at https://support.panopto.com.

]]>