RackForms v7.9.0
Security Notice
Site Tag Line
Latest Release: Build 959 - November 6, 2025
Contact Us  Download Download Contact Us
header-image


 

Critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619): what RackForms users should do

Updated October 22, 2026

Two critical flaws in PHP itself, known as "PHP2Shell", let an attacker run code on a web server without logging in. They affect every PHP site, not just RackForms. Attacks are already happening.

The fix is a PHP update. RackForms is now free, so you can also move to the latest build at no cost if a newer PHP version needs it.

What to do

  1. Update PHP on your server

    Upgrade to one of these PHP releases, or newer:

    PHP branchFixed in
    8.58.5.12
    8.48.4.27
    8.38.3.36
    8.28.2.35

    PHP 8.1 and older no longer receive fixes. If you are on one of these, move to PHP 8.2 or newer, and upgrade RackForms first (steps 2 and 3) if your build is older than 959.

    Shared hosting: choose a fixed version in your control panel (cPanel: MultiPHP Manager or Select PHP Version; Plesk: PHP Settings), or ask your host to confirm their PHP is patched.

    Your own server: install your operating system's PHP updates and restart PHP and the web server. Linux distributions often keep their own version number and add the fix to it, so check your vendor's advisory for these CVEs rather than the number alone.

  2. Download the latest RackForms

    RackForms is now free. No license key or account is needed.

    Download RackForms (zip) Build 959 (RackForms 7.9.0). Supports PHP 8.

    New installation? Follow the installation guide.

  3. Upgrade an existing RackForms installation

    Upgrading replaces the application code only. Your forms (the /output folder), entries and settings stay as they are.

    1. Back up your RackForms folder on the server, all of it.
    2. Back up your database. RackForms tables start with fb_.
    3. Upload the new /app folder from the download, replacing the existing /app folder.
    4. Restore your two configuration files from the backup in step 1: 
      app/config.php
app/movefiles/config.php
    5. Log in and test a form or two. That's it.
    Don't upload the new /output folder over your existing one; it holds your published forms.

Can't update PHP right away?

As a stopgap, add this line to your php.ini (or ask your host to) and restart PHP:

session.upload_progress.enabled = Off

This blocks the known attacks on CVE-2026-109619. It does not protect against CVE-2026-109618, so update PHP as soon as you can.

Questions

Is this a RackForms vulnerability?

No. The flaws are in PHP, so every PHP application on an affected server is exposed until PHP is updated.

Do I need a license key to upgrade?

No. RackForms is free, and recent builds no longer check a license. Older builds keep working too.

Which PHP versions does RackForms support?

RackForms has supported PHP 8 since Build 951 (2022). The latest build is 959. Pair it with a patched PHP 8.2 or newer.

How do I check my PHP version?

Your hosting control panel shows it, or run php -v on the server. The command line can use a different PHP than the website, so the control panel is the safer check.

Need help?

Email info@rackforms.com.

References