PHP Vulnerability Responses by Company

IceWarp

Global cloud / infrastructure
Aliases / services
IceWarp / icewarp.com / IceWarp Limited / IceWarp Server
Official website
https://www.icewarp.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Self-hosted IceWarp Server 14.1, 14.2 and 14.3

Response status
Patch packages available; installation required
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

PHP patch packages are available by product and OS. Current 14.3.0.13 release notes say patched PHP is included, while the main advisory still describes 14.3.0.14 onward as a future bundled release. Configuration changes for CVE-2026-115560 remain required.

Scope: Packages are available; installation on customer servers is not confirmed. Future bundled versions are not treated as released.

What users should do

Follow the matching package instructions for stopping, backup, replacement, configuration restoration, permissions and restart. Also follow step 8 for php.ini and php.user.ini. For 14.3.0.13, confirm the installed PHP and required steps with support because the documents differ.

Official service URL

Source URLs

  1. IceWarp: PHP vulnerability responsehttps://support.icewarp.com/hc/en-us/articles/52154202993041-Patch-and-mitigation-of-PHP-Vulnerabilities-CVE-2026-109618-CVE-2026-109619-and-CVE-2026-115560Response evidence
  2. https://support.icewarp.com/hc/en-us/community/posts/52224614571153https://support.icewarp.com/hc/en-us/community/posts/52224614571153Response evidence
  3. https://support.icewarp.com/hc/en-ushttps://support.icewarp.com/hc/en-usService and operation documentation

Self-hosted IceWarp Server 14.0.0.X and 13.0.3.X

Response status
Legacy patches available; installation required
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 26 update adds patched PHP 7.3 packages for 14.0.0.X and 13.0.3.X on Windows and Red Hat 7/8. Configuration changes for the additional CVE are also required.

Scope: Legacy IceWarp Server scope; partial settings-based mitigation for older versions is not a complete fix.

What users should do

Match the version and OS and follow the official replacement and configuration steps. Ask support about versions absent from the table.

Source URLs

  1. IceWarp: PHP vulnerability responsehttps://support.icewarp.com/hc/en-us/articles/52154202993041-Patch-and-mitigation-of-PHP-Vulnerabilities-CVE-2026-109618-CVE-2026-109619-and-CVE-2026-115560Response evidence
Related official sources
  1. IceWarp: PHP vulnerability responseOfficial notice
  2. IceWarp: operating-company informationOfficial information directory

Comments