Product Security › Security advisories

SATEL-SA-2026-001: critical PHP vulnerabilities in INTEGRUM

SATEL sp. z o.o. · version 1.1 · published 22 October 2026 · updated 23 October 2026

Product	INTEGRUM, software for remote security management, delivered by SATEL as a complete container
Vulnerabilities	CVE-2026-109618, CVE-2026-109619 in the PHP interpreter
Severity	critical CVSS v4.0: 9.2 (PHP project rating)
Affected versions	all INTEGRUM releases with PHP earlier than 8.3.36, i.e. released before 21 October 2026
Fixed version	release of 21 October 2026 with PHP 8.3.36, available from the update service updates.satel.pl
Exploitation	the PHP vulnerabilities are being exploited in attacks; we have no information about attacks on INTEGRUM installations
Unsupported versions	INTEGRUM 2.0 and earlier will not receive this fix, see Unsupported versions

Update without delay, starting with installations reachable from the internet.

Summary

The INTEGRUM container includes the PHP interpreter. On 21 October 2026 the PHP project released fixes for two critical vulnerabilities that let a remote attacker execute code on the server without logging in. On the same day we released an INTEGRUM update with the fixed PHP 8.3.36.

How to check whether an installation is fixed

An installation is fixed if the INTEGRUM version details show:

PHP_VERSION=8.3.36 or a later version,
Created=2026-10-21T16:42:41.793748316Z or a later date.

Every earlier release is vulnerable.

Vulnerability details

CVE-2026-109618 (PHP advisory GHSA-w8hw-w9fx-j79w). When memory runs out early in request handling, PHP aborts the request and leaves memory in an inconsistent state. Request shutdown then processes that state, which allows code execution with the privileges of the web server process.

CVE-2026-109619 (PHP advisory GHSA-6wmf-4rv5-p3rp). A worker process that serves consecutive requests keeps a reference to memory freed after a previous request (use-after-free). The result is the same: code execution with the privileges of the web server process.

Both vulnerabilities have the CVSS vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The attack requires no login, and application login does not block it. The PHP project states that updating PHP is the only complete mitigation; configuration changes do not fully protect.

Impact on INTEGRUM

An attacker who can send HTTP requests to the INTEGRUM web interface can execute arbitrary code in the INTEGRUM container with the privileges of the web server. This gives access to INTEGRUM data and functions, including management of connected alarm and access control systems.

Installations reachable from the internet are the most exposed. We recommend installing INTEGRUM on a local network only. In that setup the attacker needs access to that network, which reduces the risk but does not remove it.

What to do

Update INTEGRUM through updates.satel.pl to the release of 21 October 2026 or later.
Check in the version details that PHP_VERSION is 8.3.36 or later.
If INTEGRUM was reachable from the internet before the update, follow the steps in "Installations reachable from the internet".

Until you can update

If you cannot update right away, block access to the INTEGRUM web interface from the internet at the firewall and provide remote access through a VPN. This limits who can attack the installation but does not remove the vulnerability.

Unsupported versions

Support for INTEGRUM 2.0 and earlier has ended. These versions no longer receive security updates, so they will not receive this fix either. We recommend that users of these versions migrate to the current version of INTEGRUM. Until then, keep the server off the internet (access through a VPN only) and place it in a separate network segment.

The migration path, the risks of continued use and interim recommendations are described on the End of product support page.

Installations reachable from the internet

Details of the vulnerabilities leaked on 20 October 2026, before the PHP fixes were released. If INTEGRUM was reachable from the internet during that time:

before updating, keep a copy of the INTEGRUM web server logs, because replacing the container may remove them;
review the logs from 20 October 2026 for unusual requests and server errors;
check INTEGRUM for unknown accounts or permission changes;
if you suspect a compromise, report it through the form below and change the passwords of INTEGRUM users after the update.

Exploitation

Security companies have reported attacks using these PHP vulnerabilities since 21 October 2026. We have no information about attacks on INTEGRUM installations. The attacks are automated, so they can reach any installation exposed to the internet.

References

PHP, CVE-2026-109618: GHSA-w8hw-w9fx-j79w
PHP, CVE-2026-109619: GHSA-6wmf-4rv5-p3rp
PHP 8.3.36 changelog
NVD: CVE-2026-109618, CVE-2026-109619
INTEGRUM product page

Acknowledgements

The vulnerabilities were fixed by the PHP project. The people who reported them are credited in the PHP advisories.

Contact

Send questions about this advisory and reports of a possible compromise through the report form.

Report form

Backup channel: psirt@satel.pl

Revision history

Version	Date	Change
1.0	22 October 2026	Initial publication
1.1	23 October 2026	Fixed release identified by the container image `Created` field; added information on unsupported versions