Document PHP CVE mitigations

Co-authored-by: sstidl <12804296+sstidl@users.noreply.github.com>

README.md

@@ -32,10 +32,12 @@ Works with mobile versions too.
 ## Server requirements
 
 * A reasonably fast web server with Apache 2 (nginx, IIS also supported)
-* PHP 5.4 or newer (other backends also available)
+* PHP 5.4 or newer (other backends also available; this is a compatibility minimum, not a security recommendation)
 * MariaDB or MySQL database to store test results (optional, Microsoft SQL Server, PostgreSQL and SQLite also supported)
 * A fast! internet connection
 
+Use a currently supported PHP release and keep it up to date. See the [PHP security guidance](doc.md#php-security) for important information about CVE-2026-109618 and CVE-2026-109619.
+
 ## Installation
 
 Assuming you have PHP and a web server installed, the installation steps are quite simple.

doc.md

@@ -45,7 +45,7 @@ More videos will be added later.
 Server side, you'll need:
 
 * Apache 2 (nginx and IIS also supported). A fast internet connection is required (possibly gigabit), and the web server must accept large POST requests (up to 20MB)
-* PHP 5.4 or newer (8.0 required for ISP and distance detection), a 64-bit version is strongly recommended
+* PHP 5.4 or newer (8.0 required for ISP and distance detection), a 64-bit version is strongly recommended. This is a compatibility minimum, not a security recommendation; use a currently supported PHP release.
 * OpenSSL and its PHP module (this is usually installed automatically by most distros)
 * If you want to store test results (telemetry), one of the following:
   * MySQL/MariaDB and its PHP PDO module
@@ -56,6 +56,12 @@ Server side, you'll need:
   * FreeType 2 and its PHP module
   * The PHP gd library
 
+#### PHP security
+
+PHP releases before the security fixes for [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) may be vulnerable to remote code execution. Upgrade to a patched release as soon as possible: PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a later release in the same maintained branch. PHP 8.1 and older are no longer supported upstream; use a supported PHP version, or verify with your OS vendor that its package includes the security fixes.
+
+These vulnerabilities are in PHP itself, not LibreSpeed. No LibreSpeed code or configuration change fully mitigates them; PHP workarounds are not a substitute for applying the security update. Restart PHP and any persistent PHP workers after upgrading.
+
 Let's install the speed test.
 
 Put all files on your web server via FTP or by copying them directly. You can install it in the root, or in a subdirectory.
@@ -187,7 +193,7 @@ This is the server that your users will first connect to. It hosts the UI, the J
 Requirements:
 
 * Apache 2 (nginx and IIS also supported). A fast connection is not mandatory, but is still recommended
-* PHP 5.4 or newer, a 64-bit version is strongly recommended
+* PHP 5.4 or newer, a 64-bit version is strongly recommended. This is a compatibility minimum, not a security recommendation; use a currently supported PHP release and follow the [PHP security guidance](#php-security).
 * If you want to store test results (telemetry), one of the following:
   * MySQL/MariaDB and its PHP PDO module
   * PostgreSQL and its PHP PDO module
@@ -286,7 +292,7 @@ These are the servers that will actually be used to perform the test.
 Requirements:
 
 * Apache 2 (nginx and IIS also supported). A fast internet connection is required (possibly gigabit), and the web server must accept large POST requests (up to 20MB)
-* PHP 5.4 or newer (8.0 required for ISP and distance detection)
+* PHP 5.4 or newer (8.0 required for ISP and distance detection); this is a compatibility minimum, not a security recommendation. Use a currently supported PHP release and follow the [PHP security guidance](#php-security).
 * OpenSSL and its PHP module (this is usually installed automatically by most distros)
 
 To install a backend, simply copy all the files in the `backend` folder to your backend server.

doc_docker.md

@@ -49,6 +49,8 @@ services:
 
 Please adjust the environment variables according to the intended operating mode.
 
+The Docker images include a PHP runtime. Ensure the PHP version in your image includes all security updates; pull and redeploy updated images when available. For custom builds, rebuild with an updated PHP base image or Alpine package; updating LibreSpeed files alone does not update the PHP runtime. See the [PHP security guidance](doc.md#php-security).
+
 ## Standalone mode
 
 If you want to install LibreSpeed on a single server, you need to configure it in standalone mode. To do this, set the `MODE` environment variable to `standalone`.