PHP has released emergency fixes for CVE-2026-109618 and CVE-2026-109619, both rated critical at CVSS 9.2. They can allow unauthenticated remote code execution. One involves unsafe out-of-memory cleanup; the other involves stale internal state across requests. Apache mod_php has a demonstrated attack before application code runs. PHP-FPM also requires patching. See the official announcement.

1. Check and update PHP

Back up your database, application files and configuration. Identify every runtime:

php -v
php --ini
dpkg -l 'php*' 'libapache2-mod-php*'

The CLI version may differ from the website. Check each virtual host, FPM pool, container and hosting panel.

Install these or later supported security releases. For PHP 8.3-FPM:

sudo apt update
apt-cache policy php8.3-common php8.3-fpm
sudo apt upgrade
sudo php-fpm8.3 -t
sudo systemctl restart php8.3-fpm

Substitute 8.4 or 8.5 for your installed branch. Review package upgrades, including extensions. If Apache uses mod_php:

sudo apache2ctl configtest
sudo systemctl restart apache2

Check vendor backports. Ubuntu fixes include 8.3.6-0ubuntu0.24.04.13 for 24.04 and 8.5.4-0ubuntu1.5 for 26.04. Compare complete revisions against Ubuntu’s security notice. Other repositories need their own advisories. An older-looking version can contain the fix.

Confirm the web runtime afterward and test login, uploads and database access. Updating WordPress or OJS alone does not update PHP.

2. Update containers separately

Host updates do not patch container PHP. Confirm a patched image exists, then replace app with your Compose service:

docker compose pull app
docker compose up -d --no-deps app
docker compose exec app php -v

Custom images require an updated base image and rebuild. Preserve persistent data. Shared-hosting users should request the exact patched revision.

3. Limit requests before PHP

In Nginx’s relevant server block:

client_max_body_size 8m;

Or inside the Apache virtual host:

LimitRequestBody 8388608

See the Nginx and Apache documentation. These impose an 8 MiB body limit. Adjust for legitimate uploads. In the active web runtime’s php.ini:

post_max_size = 8M
upload_max_filesize = 6M
max_file_uploads = 5
max_input_vars = 1000
max_input_nesting_level = 32
session.upload_progress.enabled = 0

Typical Ubuntu paths are /etc/php/8.3/fpm/php.ini for FPM and /etc/php/8.3/apache2/php.ini for mod_php. Adjust the branch number. php --ini reports CLI configuration only.

Test these example values. Disable file uploads if unused. Apply upload-progress settings at startup, then restart workers; application code and FPM .user.ini are too late for the confirmed early path.

Test Nginx with sudo nginx -t before reloading, or Apache with sudo apache2ctl configtest. These limits reduce exposure; they do not fix either CVE.

4. Emergency mitigation while patching

Prefer removing public PHP access and serving a static maintenance page. A PHP maintenance plugin still invokes PHP.

The OOM advisory recommends this incomplete emergency measure in the relevant FPM pool, such as /etc/php/8.3/fpm/pool.d/www.conf:

php_admin_value[memory_limit] = -1

This removes one controllable OOM trigger but permits unlimited per-request PHP memory, increasing denial-of-service risk. Use frontend limits and suitable cgroup/container boundaries. Underlying allocation failures remain dangerous; do not substitute RLIMIT_AS or RLIMIT_DATA. Audit overrides and restart all workers. Restore suitable finite PHP limits after patching.

For PHP 8.5, also set fatal_error_backtraces=0 in startup configuration. Remove invalid or obsolete per-request INI settings. These address specific stale-state paths only. Hiding warnings provides no protection.

5. Retire public PHP 7.4 applications

PHP 7.4 reached upstream end of life on 28 November 2022. Retire unused applications or migrate them to supported PHP. Legacy source patches and vendor fixes exist, but require explicit verification and should support temporary migration arrangements.

Remove forgotten subdomains, restrict administration through VPN/access policies, and keep FPM off public port 9000. Review logs, unexpected files, accounts and scheduled tasks. Patching does not remove existing backdoors. If compromise is suspected, isolate the system and preserve evidence. Follow NCSC guidance.

The post Critical PHP Flaws: How to Update PHP 8.3, 8.4 and 8.5 appeared first on mypapit gnu/linux .

Microsoft Word documents are common in research, teaching, and administration. When preparing these documents for a large language model (LLM), converting them to Markdown gives you a readable text file that you can inspect, edit, and supply to an AI application.

Pandoc is a command-line document converter available on Linux. It supports Microsoft DOCX input and several Markdown formats, making it useful for preparing manuscripts, reports, lecture notes, and technical documentation. Its focus is document structure, rather than reproducing the original page layout. Pandoc documentation

For academic writing, sections such as Introduction, Methods, Results, and Discussion provide useful boundaries. A retrieval system can divide a document at these boundaries and retrieve relevant passages when answering a question. Microsoft’s Azure AI Search documentation provides a concrete example of indexing Markdown by heading and retaining section information. This supports using Markdown as a practical format for structured retrieval. Microsoft documentation

The practical benefits include:

• Visible input: You can review the actual text supplied to the AI application.
• Reusable content: The same file can support summarisation, question answering, search, and a document knowledge base.
• Source tracking: Keeping the title, authors, DOI, and source URL helps connect extracted claims to their original document.
• Controlled selection: You can provide relevant sections instead of repeatedly submitting the complete document.

Markdown does not make an LLM automatically understand a document better or prevent invented answers. It also does not necessarily reduce token usage compared with a good DOCX text extractor. File size on disk is not a reliable measure of model input tokens. The benefit is greater control over the text and structure entering your workflow.

How to convert DOCX documents to Markdown in Ubuntu / Linux

Step 1: Install Pandoc

sudo apt install pandoc

Ubuntu’s repository version may be older than the latest upstream release. If you need a newer feature or conversion fix, consult the official Pandoc installation instructions. A LaTeX installation is unnecessary for DOCX-to-Markdown conversion.

Step 2 : Convert DOCX to Markdown (single file)

pandoc "report.docx" --from=docx --to=gfm --wrap=none -o "report.md"

For an academic manuscript with footnotes and equations, Pandoc’s own Markdown format is another useful choice:

To extract embedded images and update their references:

pandoc "report.docx" --from=docx --to=markdown --wrap=none \
  --extract-media="report-assets" -o "report.md

These formats and options are documented in the Pandoc User’s Guide. Running another example with the same output filename replaces the previous Markdown file.

An image reference does not give a text-only model access to the image’s contents. Supply figures separately to a vision-capable system, or add verified descriptions and relevant values as text.

Step 3: Review the converted document

Compare it with the Word original. Check section headings, numerical results, units, table labels, equations, references, and figure captions. Complex tables and formatting may not survive conversion accurately. Pandoc conversion limitations

For research documents, retain the qualifications attached to findings. A reported accuracy value without its dataset, evaluation method, or limitations can produce a misleading summary.

Step 4: Use the Markdown with an LLM

Upload the file to an application that accepts Markdown, or paste a relevant section into the conversation. For a larger collection, configure your retrieval workflow to preserve document identity and section headings with each passage.

A useful starting prompt is:

Using only the supplied document, identify the research objective, method, dataset, main results, and limitations. Cite the relevant section for each item. Preserve numerical values and units exactly. If information is absent, state “not reported”.

BONUS: Batch convert all DOCX files with bash

For a folder containing several documents, save the following script as batch-docx-to-markdown.sh

The script can be downloaded here in this gist: https://gist.github.com/mypapit/df6615f8611f03678bc93ee0485001be#file-batch-docx-to-markdown-sh

The post Convert Word Documents to Markdown for LLM / AI consumptions appeared first on mypapit gnu/linux .