Revolving around the core of technology
Security Advisory — SA-2026-001
CVE-2026-109618 CVE-2026-109619 CVSS 9.2 — Critical
Published: October 22, 2026 · Affects: Syncrify / SynaMan Virtual Appliance (Rainloop / PHP component) · Syncrify and SynaMan cores: Not affected
PHP2Shell (disclosed October 20, 2026) refers to two critical remote code execution vulnerabilities in the PHP runtime engine:
Both flaws affect PHP versions 5.4 through 8.5, a range spanning releases dating back to 2012. The PHP Security Team rates the combined CVSS score at 9.2; independent security firm watchTowr assigns it a perfect 10.0. Exploitation was detected in the wild prior to public disclosure.
You are affected if all three of the following are true:
Even if your firewall currently blocks port 5678, removing Rainloop and PHP is the safest long-term course of action. Firewall rules can change, and a software component that is not installed cannot be exploited.
To check whether Rainloop is present on your system, run the command in Step 1 below.
Follow these steps on the virtual appliance host. All commands require root or sudo access.
Run the following command. If the directory does not exist, Rainloop was never installed or has already been removed. In that case, skip to Step 5 to verify PHP is also absent.
sudo ls -ld /var/www/rainloop
If you need to preserve any Rainloop data or configuration before removal, create a backup first.
sudo mkdir -p /root/rainloop-backup sudo cp -a /var/www/rainloop /root/rainloop-backup/ sudo cp -a /etc/nginx/conf.d/rainloop.conf \ /etc/nginx/sites-available/rainloop.conf \ /root/rainloop-backup/
Delete the Rainloop application directory and scan for any remaining references in your web server configuration.
sudo rm -rI /var/www/rainloop sudo grep -Ril rainloop /etc/apache2 /etc/nginx 2>/dev/null
Remove the Nginx virtual host files for Rainloop. Omit any path that does not exist on your system.
sudo rm /etc/nginx/sites-enabled/rainloop.conf sudo rm /etc/nginx/sites-available/rainloop.conf sudo rm /etc/nginx/conf.d/rainloop.conf
This command lists every PHP-related package currently installed. Review the output before proceeding.
dpkg -l | awk '/^ii/ && $2 ~ /^php/ {print $2}'
Stop the running PHP FastCGI Process Manager service and prevent it from restarting at boot.
sudo systemctl stop php7.4-fpm sudo systemctl disable php7.4-fpm
Purge PHP and all of its extension packages. This removes both the binaries and their configuration files.
sudo apt purge \
php-common php7.4 php7.4-cli php7.4-common \
php7.4-curl php7.4-fpm php7.4-json php7.4-opcache \
php7.4-readline php7.4-xml
Run each check below after completing the steps above. Every check should return no output or confirm removal.
| What to check | Command | Expected result |
|---|---|---|
| No Rainloop files remain | sudo find /var/www /var/lib /opt /etc /usr/share \ -iname '*rainloop*' -print 2>/dev/null |
No output |
| No Rainloop web server config remains | sudo grep -Ril rainloop \ /etc/nginx /etc/apache2 2>/dev/null |
No output |
| Config files specifically removed | for f in \
/etc/nginx/conf.d/rainloop.conf \
/etc/nginx/sites-enabled/rainloop.conf \
/etc/nginx/sites-available/rainloop.conf; do
sudo test -e "$f" && echo "STILL EXISTS: $f" \
|| echo "REMOVED: $f"
done |
All lines say REMOVED |
| No PHP packages installed | dpkg -l | grep -E \ '^(ii|rc).*(php[0-9.]|php-common|libapache2-mod-php)' |
No output |
| PHP binary not present | php -v |
Command not found |
| Port 5678 no longer listening | sudo ss -lntup | grep ':5678' |
No output |