[LIFTED] Temporary restrictions on the forum and support tickets: critical PHP vulnerabilities

[Staff 10687]

Hello!

Two critical vulnerabilities in PHP, the language that powers our website, forum and support system, became public before an official fix was available (CVE-2026-109618 and CVE-2026-109619). They affect every PHP version in existence and allow an attacker to run code on a web server by sending a specially crafted request. The PHP project has scheduled fixed versions for today, 21 October, at 14:00 UTC, and attacks exploiting the flaws have already been reported by several security firms.

The flaws are triggered by a specific kind of web request, the one browsers use to submit forms with file uploads, and they act before any application code runs. Until the fix is installed, the only effective protection is to refuse that kind of request at the web server. EDIT: this sentence was not accurate.
We have done so on all our systems.

What this means for you, starting now and until further notice:

• The forum is read-only. You can read and search everything, but you cannot post new topics or replies, edit posts, upload attachments, send private messages or change your profile.
• The support ticket area is read-only as well. You can read your tickets and our replies, but you cannot open a new ticket or reply to an existing one from the website. We keep answering existing tickets, and you will keep receiving email notifications for our replies.
• The customer API (https://airvpn.org/api/) keeps working, but it rejects requests sent as multipart/form-data: if your script posts that way, send the parameters url-encoded or as JSON instead.
• Support remains available by email: write to support@airvpn.org and we will assist you as usual.
• Everything else works normally: VPN connections, Eddie and the AirVPN Suite, login, registration, purchases and the client area.

These restrictions will be lifted as soon as the official patches are available and applied to every affected component of our infrastructure. We expect most of this to happen within hours of the release; if any component takes longer, we will update this announcement.

We apologize for the inconvenience and thank you for your patience.

AirVPN Staff
 

[Staff 10687]

Update: restrictions lifted

Hello!

The PHP project released the fixed versions earlier than scheduled, and we have installed them on every system of our infrastructure.

The temporary restrictions described above have now been removed:

• The forum is writable again: you can post new topics and replies, edit posts, upload attachments,date your profile.
• The support ticket area works normally: you can open new tickets and reply to existing ones from the website.
• Password recovery works again.
• The customer API (https://airvpn.org/api/) accepts multipart/form-data requests again.

If you wrote to support@airvpn.org in the meantime, there is no need to open a ticket as well: we will answer you there. If any of the functions above still fails for you, please clear your browser cache and try again; if the
problem persists, open a ticket or write to support@airvpn.org.

VPN connections, Eddie and the AirVPN Suite were not affected at any time.

Thank you for your patience and understanding.

AirVPN Staff