The PHP project has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). PHP rates both CVSS 9.2 and states they can allow unauthenticated remote code execution. Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP security advisory). We recommend every TestRail Server customer review this guidance with their security team and act promptly.
- TestRail 10.x (PHP 8.3): update PHP to 8.3.36.
- TestRail 8.0.1 to 9.8.1 (PHP 8.1 or 8.0): the PHP project does not publish releases for these end-of-life branches. Use a patched PHP package from your OS or hosting vendor where one is available, or upgrade TestRail to 10.x on PHP 8.3.36.
- TestRail 7.5 (PHP 7.3 or 7.4): upgrade TestRail. On PHP 7.4, a patched package from your OS vendor may be available in the meantime.
PHP states that every PHP installation serving web requests is at risk, including PHP-FPM, and considers Apache with mod_php the highest-risk setup. TestRail's Linux requirements list Apache with mod_php or an equivalent, so check which setup your installation uses. Where patching is not immediately feasible, CERT-EU advises considering isolating internet-facing systems from public networks until a fix is applied and verified (CERT-EU advisory).
Before you act
- This guidance is provided for information, as of the date above. It summarizes public advisories from the PHP project and CERT-EU, which may change; their advisories are the authoritative source.
- TestRail Server is supported only on the PHP versions listed in its installation requirements. PHP packages from OS or hosting vendors, and any PHP you build yourself, have not been tested by us.
- Test every change in a non-production environment first, and take a backup of your TestRail installation and database before upgrading.
- If you are unsure which option applies to you, contact TestRail support.
Remediation options by TestRail version
Find your TestRail version and platform, then apply the recommended fix. Options are listed in order of preference.
| TestRail version | Platform | PHP in use | PHP branch status | Recommended | Alternative or interim |
|---|---|---|---|---|---|
| 10.0.1 to 10.9.0 | Linux | 8.3 | Supported by PHP (security fixes to 31 Dec 2027) | Update to PHP 8.3.36 from your OS vendor's packages | If no package is available yet: apply PHP's interim measures and restrict network access until updated |
| 10.0.1 to 10.9.0 | Windows | 8.3 | Supported by PHP | Install the PHP 8.3.36 Windows binaries from php.net | If you can't update immediately: apply PHP's interim measures and restrict network access until updated |
| 9.4.1 to 9.8.1 | Linux | 8.1 | End of life; patched packages offered by some OS and hosting vendors | Install your vendor's patched PHP 8.1 package and confirm its notice lists both CVEs | Upgrade TestRail to 10.x on PHP 8.3.36 |
| 9.4.1 to 9.8.1 | Windows | 8.1 | End of life; no patched Windows release from PHP | Upgrade TestRail to 10.x on PHP 8.3.36 | Until upgraded: apply PHP's interim measures and restrict network access |
| 8.0.1 to 9.3.2 | Linux | 8.1 | End of life; patched packages offered by some OS and hosting vendors | Install your vendor's patched PHP 8.1 package and confirm its notice lists both CVEs | Upgrade TestRail to 10.x (see upgrade path note) |
| 8.0.1 to 9.3.2 | Windows | 8.1 or 8.0 | End of life; no patched Windows release from PHP | Upgrade TestRail to 10.x (see upgrade path note) | Until upgraded: apply PHP's interim measures and restrict network access |
| 7.5 | Linux | 7.4 | End of life; patched packages offered by some OS vendors | Upgrade TestRail (see upgrade path note) | Until upgraded: your vendor's patched PHP 7.4 package, if available |
| 7.5 | Windows | 7.4 | End of life; no patched Windows release from PHP | Upgrade TestRail (see upgrade path note) | Until upgraded: apply PHP's interim measures and restrict network access |
| 7.5 | Linux or Windows | 7.3 | End of life; no fix from the PHP project | Upgrade TestRail (see upgrade path note) | Until upgraded: isolate the server from public networks |
Upgrade path note: follow the supported upgrade path in TestRail's upgrade guides for your version. Versions before 9.5.1 use Cassandra, so the Cassandra deprecation script must be run on 9.4.1 before upgrading further; TestRail 7.5 must first go to 8.0.1 and 8.0.4. Upgrading from 8.x means passing through 9.3.0 and 9.8.1, which include changes that need planning. See "Before you upgrade: changes since TestRail 7.5" below.
Long-term: PHP 8.2 reaches end of life on 31 December 2026 (PHP supported versions), and fixes for end-of-life branches are not guaranteed for future vulnerabilities. Running TestRail 10.x on PHP 8.3, supported by PHP until 31 December 2027, is the durable option.
About PHP's source backports: PHP has also published source-code backports for 7.4, 8.0 and 8.1, intended for organisations that build PHP themselves. A self-built PHP is not a tested or supported configuration for TestRail Server, so we don't list it as an option above.
Before you upgrade: changes since TestRail 7.5
If you are upgrading from 8.x to fix this, you will pass through each of the changes below. Some of them cannot be reversed from within the application, so read this section before you plan the upgrade. The release notes are the authoritative source: TestRail Server releases.
Plan for one-way changes. Take a full backup of the TestRail files and database before every upgrade step. Restoring that backup is the only supported way back to an earlier state.
Changes that need action or planning
This is a summary. Each row links to the release notes or documentation for the full details.
| Version | Change | What to do | More information |
|---|---|---|---|
| 8.0 | TestRail moves to PHP 8.1. Versions older than 7.0 are no longer supported. | Upgrade to 7.5 first, then 8.0.1, then 8.0.4. | 8.0 release notes |
| 8.0.1 | If you are upgrading from 7.0.2 or earlier and need to migrate attachments, the migration script must be run after the 8.0.1 upgrade. | Run the script at the 8.0.1 step, not later. | 8.0.4 release notes |
| 9.0 | Major UI/UX redesign. The navigation and sidebar are redesigned and keyboard navigation is added. The dark and classic themes are removed. | Tell your users before the upgrade. Update any UI scripts that rely on the old sidebar, because they will break. | 9.0 release notes |
| 9.2 | Docker deployments need a TR_CHROME_PATH line added to _config/config.php after the upgrade. | Add the line after upgrading. | 9.2.1 release notes |
| 9.3.0 | Jira OAuth 2.0. The native Jira integration for Jira Cloud and Jira Data Center now supports authentication with OAuth. All existing Jira integrations will be cleared as part of this update. Customers will need to re-configure their Instance, Project, and User-level integrations after upgrading to 9.3.0. | Note your current Jira settings first, and plan time to re-configure afterwards. This applies to everyone upgrading from 8.x, because the route to 10.x passes through 9.3.0. The previous integration for Jira Server remains available. | 9.3.0 release notes, Connect to Jira Cloud, Connect to Jira Data Center |
| 9.3.1 and later | Breaking API change: the get_suites endpoint now supports pagination. | Check scripts and integrations that call get_suites. | 9.3.1 release notes |
| 9.5.1 | Cassandra is deprecated and enforcement is in place. The upgrade is blocked if the Cassandra deprecation script has not been run. | Run the Cassandra deprecation script on 9.4.1 before upgrading further. | 9.5.1 release notes |
| 9.8.1 | Rich text editor. Text fields move from markdown-only formatting to a WYSIWYG editor, and content is stored in HTML format. Existing markdown content is upgraded. There is no downgrade path: the release notes state that restoring a pre-upgrade backup may be required to return to the previous state. | Take a backup immediately before this step and test in a staging environment first. If you have API integrations that create or update content in these fields, validate their payload formatting and rendered output. | 9.8.1 release notes, Text Editor formatting reference |
| 10.0 | The platform moves to PHP 8.3. Jira Issue Connect is introduced for Jira Cloud. | Plan the PHP change as part of the upgrade. | 10.0.1 release notes |
| 10.1 | AI features are enabled by default, and Smart Archiving of inactive test runs and plans is enabled by default. | Administrators who do not want these can change the settings after upgrading. | 10.1.4 release notes, Smart Archiving |
| 10.4 | A limit of 150 custom fields per instance is enforced. Existing custom fields are not affected. | Check your custom field count before creating new ones. | 10.4.1 release notes |
| 10.4 and later | The upgrade guides include a new step: suspend the background task before upgrading. | Follow the current upgrade guide for your platform. | Upgrading on Unix/Linux, Upgrading on Windows |
Upgrade to the latest 10.x release
When you upgrade to fix this vulnerability, we recommend going to the latest 10.x release available at the time (10.9.x at the time of writing) rather than an earlier 10.x build. Later 10.x releases include fixes for upgrade and data migration issues found in earlier ones, for example in the 10.7.1 and 10.8.1 release notes. TestRail 10.5.1 has been superseded and is no longer available for download. Check the Server releases page for the current version.
Required upgrade path
From 7.0 or earlier: 7.5, then 8.0.1, then 8.0.4, then 9.4.1, then your target 10.x release. Run the Cassandra deprecation script on 9.4.1. The release notes recommend moving through each major version in sequence because of database changes along the way.
Why older TestRail versions can't just move to a newer PHP
TestRail Server 8.0.1 to 9.8.1 requires PHP 8.1 (8.0 is also listed for some Windows versions), and its installation guides use the PHP 8.1 ionCube loader. Running these versions on PHP 8.2 or later is not supported. For these versions, a fixed PHP must come from a patched 8.1 package, or you can upgrade TestRail to 10.x, which runs on PHP 8.3 (installation requirements).
Confirming your PHP is patched
Patched packages for end-of-life PHP branches often keep the same version number as before, so the version number alone may not show whether the fix is installed. Confirm with your OS or hosting vendor, through their security notice or support channel, that the PHP you have installed addresses both CVE-2026-109618 and CVE-2026-109619.
Not every vendor offers a patched package for every end-of-life branch. If yours does not, upgrade TestRail, or apply PHP's interim measures below until you can.
Apply any update following your vendor's instructions, restart your web server and all PHP workers so the update takes effect, then confirm TestRail works as expected, including attachment uploads, before returning to normal use.
Interim measures until you can patch
PHP states that only an update fully fixes these vulnerabilities. Its advisory lists temporary measures that reduce exposure to specific attack paths but do not make an installation safe. If you cannot update immediately, review those measures with your security team using the official sources, which are authoritative and may be updated:
Some of these measures change how PHP handles memory and request size, which can affect TestRail, for example attachment uploads and large imports or exports. Test any configuration change in a non-production environment first.
Where patching is not immediately feasible, CERT-EU advises considering isolating internet-facing systems from public networks until a fix is applied and verified.
Sources
- PHP security advisory, 21 Oct 2026
- PHP supported versions
- CERT-EU Security Advisory 2026-018
- TestRail Installation Requirements 9.4.1 to 10.9.0
- TestRail Installation requirements – 7.5
- TestRail: Preparing your Windows server – 9.4.1 to 9.8.1
- TestRail Server release notes
- TestRail 9.3.0 release notes (Jira OAuth 2.0)
- TestRail 9.8.1 Server release notes (rich text editor)