Critical PHP Remote Code Execution Vulnerabilities (php2shell) Fixed

On October 21, 2026, the PHP project released urgent security updates for two critical vulnerabilities, known as php2shell. Under certain conditions they allow an unauthenticated attacker to execute code on servers running PHP, and word of the vulnerabilities leaked a day before the official announcement. The UVS Manager web interface runs on PHP 8.4 (nginx with PHP-FPM), so 4.19.8 upgrades PHP to the fixed 8.4.27. This is the primary purpose of the release.

The Two CVEs Fixed in This Release

Descriptions and CVSS scores are taken from the official PHP announcement. UniVirStor 4.19.7 and all earlier versions ship PHP builds without this fix, so we recommend that all customers upgrade as soon as possible.

What 4.19.8 Covers

Interim Protection Before Upgrading

Until the upgrade is complete, we recommend allowing only trusted management networks to reach the UVS Manager web interface, for example by restricting source addresses with UFW Manager or your existing firewall. This reduces the risk but does not replace the upgrade.

Operating System and Ceph Updated Together

Rather than updating PHP alone, this release takes the opportunity to refresh the entire runtime environment.

Ceph Upgraded to 19.2.7

On October 12, 2026, the Ceph project released Squid 19.2.7, the seventh maintenance release in the Squid series. It fixes CephFS client crashes and deadlocks among other issues, and the Ceph project recommends that all deployments update. Both newly deployed and upgraded UniVirStor 4.19.8 clusters run this version, and offline sites can complete the upgrade with the container images bundled in the upgrade package, without internet access.

Operating System and Service Packages

The operating system kernel, nginx, Samba, time synchronization, and other system packages receive the latest security and maintenance updates.

Shorter Upgrade Time

When an upgrade includes a new operating system kernel, each node must be rebooted in turn. Starting with 4.19.8, the final reboot of the upgrade uses a kexec warm reboot: the new kernel is loaded directly, skipping the BIOS/UEFI power-on self-test and RAID/HBA initialization, which shortens each node's reboot and the time its OSDs are offline. Platforms that cannot use a warm reboot automatically fall back to a normal reboot, and the upgrade continues as usual.

How to Upgrade

Upgrades are carried out with the help of Ambedded support. Nodes are upgraded one at a time, and the services on each node restart briefly in turn. We recommend scheduling the upgrade in a maintenance window.

New: CephFS Snapshot and Schedule Management

The CephFS page adds a Snapshot & Schedule tab, so snapshot management that previously required Ceph commands can now be done directly in UVS Manager.

Manual Snapshots

Select a directory or subvolume in the directory tree to create, view, and delete snapshots, with the creation time of each snapshot shown.

Snapshot Schedules and Retention Rules

Create recurring snapshot schedules for a directory (for example hourly, daily, weekly, or monthly), and edit, delete, or pause them. With retention rules, the system automatically removes snapshots that fall outside the policy, for example keeping the last 24 hourly and 7 daily snapshots.

How Much Space Snapshots Use

CephFS snapshots are copy-on-write: creating a snapshot does not copy the data. The additional space comes from old data that has been modified or deleted after the snapshot was taken but must still be kept by the snapshot, and the raw disk usage is that amount multiplied by the data pool's replica count or erasure-coding overhead. Plan retention rules with your data change rate in mind.

NFS: Anonymous UID/GID Set Per NFS Cluster

Previously, the NFS anonymous UID/GID (Anonymous ID) was a global setting shared by all NFS clusters. In 4.19.8 it is set per NFS cluster: you can specify it when creating an NFS cluster and view or change it later when editing the cluster, and the values shown are the ones actually in effect in Ceph. A change applies only to that cluster and does not affect the others.

This lets you separate clients with different trust levels, for example mapping a cluster that serves internal workstations to domain users while mapping a cluster for external or lab hosts to an unprivileged account. It also fixes an issue in earlier versions where changing or clearing the Anonymous ID of a cluster that already had one reported success but left the actual setting unchanged. After upgrading from an earlier version, each cluster keeps the settings actually in effect in Ceph; check the anonymous UID/GID on each cluster's edit screen to confirm they are as expected.

NFSv3 Fixes

When several NFS clusters enable NFSv3, each now uses its own configuration without affecting the others, and adding a host to an NFS service with NFSv3 enabled no longer breaks its NFSv3 settings.

System Time: Multiple NTP Sources

UVS Manager previously supported a single NTP server. 4.19.8 supports multiple external NTP servers and lets you choose whether the Ceph MON nodes provide internal time synchronization for the cluster; internal and external sources can be used together. Multiple independent time sources let the system cross-check them and exclude a faulty clock, which matters especially for a distributed system such as Ceph that depends on consistent time across nodes. The time zone setting is now a searchable list as well.

Monitoring, Reports, and Notifications

SMB and NFS Service Status on the Dashboard

Storage Service Status on the Dashboard now includes SMB and NFS, showing the number and status of these services at a glance.

More Accurate Memory Usage

Dashboard memory usage is now calculated from the available memory reported by the Linux kernel, so reclaimable file cache is no longer counted as used. This avoids persistently high readings that could be mistaken for a memory shortage.

Report Time Range and Time Zone

Cluster Report calculates full days in the cluster's time zone (00:00 on the start date to 24:00 on the end date) and clearly shows the start time, end time, and time zone, and the dates of manual reports now match those of scheduled report emails. Scheduled report emails also include a PDF version of the report, and wide tables in the PDF are now shown in full instead of being cut off.

SMTP Servers Without Authentication

The SMTP username and password in the notification settings are now optional, so an internal mail relay that does not require authentication can be used. At least one recipient is now required.

Fixes

CephFS Mounting From Older Linux Kernels

In 4.19.7, CephX users created from the interface always received aes256k keys, so kernel clients older than Linux 7.0 could not mount with the command generated by HOW TO MOUNT. In 4.19.8, HOW TO MOUNT lets you choose AES-128 or AES-256 when creating the default user: AES-128 works with Linux kernels older than 7.0, and AES-256 is for clients that support the new key type, so there is no longer any need to create a compatible user with commands. In addition, the CephX Auth page now shows the error returned by Ceph when creating, editing, or deleting a user fails, instead of reporting success.

SMB

Closing sessions and open files on the SMB STATUS page now takes effect, works for connections held by other nodes, and shows an error if the operation fails. Adding an SMB share no longer overwrites the permissions of the subvolume group root directory, permission handling is now the same for adding and editing shares, and a domain user and group can be selected as the owner when editing a share. After an LVS VIP is set, the SMB cluster service no longer restarts repeatedly and drops connections, and deleting the LVS VIP now removes the address from every node.

UFW Manager Firewall

Rule import now accepts rules whose source or destination is a network (CIDR), so files exported by UVS can be imported back unchanged, and a failed import now shows an error instead of reporting success. A rule whose destination is a network also no longer loses that network when edited or exported, which previously widened it to any address.

S3 Object Storage (RGW)

When adding a zone placement and switching the Bucket Index Pool option from “Use existing pool” back to “Create”, a new index pool is now created correctly with the selected CRUSH rule. A new Reset Endpoint action resynchronizes the zone and zonegroup endpoints from UVS Manager after RGW services have been changed elsewhere, such as in the Ceph Dashboard.

System Logs

Management interface logs are now compressed daily, preventing the log directory from growing without limit and filling the system disk.

Frequently Asked Questions

▾What are the main updates in UniVirStor 4.19.8?

▾Is my system affected by php2shell?

▾Will services be interrupted during the upgrade?

▾Can Linux kernels older than 7.0 now mount CephFS?

▾How much space do CephFS snapshots use?