The cause is two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, which PHP announced on 20 October. CERT-EU rated them CVSS 9.2 and warned that they could allow remote code execution (advisory 2026-018). Phabricator is written in PHP, so an internet-facing review server running a vulnerable PHP version was directly exposed.
The FreeBSD cluster administrators stopped the service so that the PHP ports could be updated and the fixes deployed before bringing it back. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.13. The vulnerabilities are documented in the FreeBSD VuXML database (commit 22d99be8a8c1), so pkg audit -F warns anyone running an affected PHP package.
Phabricator was shut down before the proof-of-concept (PoC) exploit leaked, so the review server was never exposed while a public exploit existed.
Interesting enough most Linux distributions shipped fixes within an hour.
php82-8.2.34 is vulnerable: PHP -- Multiple vulnerabilities CVE: CVE-2026-109618 CVE: CVE-2026-109619 WWW: https://vuxml.FreeBSD.org/freebsd/d8e16d08-cd2f-11f1-8135-8447094a420f.html
https://www.php.net/archive/2026.php#2026-10-20-1
https://cert.europa.eu/publications/security-advisories/2026-018
