Hotfix and Update Available for PHP Remote Code Execution Vulnerability
At Green Rocket Security, the security of our products and the safety of our customers’ data are our absolute priorities. We are issuing this advisory to inform you about a critical vulnerability recently discovered in the PHP ecosystem and to confirm that GreenRADIUS has been successfully patched.
The Bug: What Happened?
A critical flaw was identified in the way certain versions of PHP handle environment variables during requests. Under specific configurations, an attacker could inject malicious code via specially crafted HTTP headers. This allows the attacker to execute arbitrary code on the server hosting the application, bypassing built-in security controls. Because GreenRADIUS utilizes PHP as part of its core architecture, our threat intelligence team immediately flagged this issue for evaluation.
Our Response and Mitigation
Upon learning of the vulnerability, our engineering and data security teams isolated the affected components within GreenRADIUS. We developed and thoroughly tested a patch to ensure complete remediation.
We have officially released update v6.1.18.18 that addresses CVE-2026-109618 and CVE-2026-109619. Hotfix v6.1.18.18-1 addresses CVE-2026-115560. Update v7.1.1 addresses all three of these.
Next Steps for Customers
We strongly recommend applying the latest update immediately to protect your environment.
We remain committed to transparency and maintaining the highest security standards for our products. If you have questions or require technical assistance during the update process, please reach out to our dedicated Support Team.
