Two critical security vulnerability have recently been identified in PHP, a component used by RecordPoint's File Connect Enterprise (FCEv3) application to support portions of the web interface.

Updated PHP versions have been released to address this vulnerability. Customers using FCEv3 are advised to review their current PHP version and apply the appropriate security update.

The required action depends on the version of FCEv3 currently installed.

For customers unable to upgrade immediately, a security update is available for PHP 8.1 as an interim mitigation.

Upgrades to FCE 3.1 performed on or after 22 October 2026 will likely include the patched PHP version. Customers should verify the installed PHP version following the upgrade and apply the update instructions below if required.

The following instructions apply to FCE 3.1 installations using PHP 8.4 provided by the Remi repository.

Run the following command to identify the installed PHP version:

Example output for PHP 8.4.26:

You can also verify the PHP version directly:

If the installed version is earlier than 8.4.27, an update is required.

First, confirm that the Remi repository is enabled:

Refresh the repository to check for available updates:

Run:

Updated command:

Confirm that PHP version 8.4.27 or later is listed.

Example output:

Note: The updated packages may take some time to become available across all repositories. If the required version is not listed, wait until it becomes available before proceeding.

Run:

Updated command:

Review the proposed updates and confirm that the PHP 8.4 packages, including php84-php-fpm, are being upgraded to version 8.4.27 or later.

Enter y to proceed.

Once complete, run:

Restart PHP-FPM and Nginx to apply the update:

Confirm both services are running:

Both services should display:

Confirm the new PHP version:

Expected output:

You can also confirm the installed package version:

Expected output:

Note: A later patched version is also acceptable.

Once the update is complete, verify that the application is operating normally.

Check that Nginx and PHP-FPM are running:

Test the Diskover Web endpoint:

Finally, open the Diskover Web interface in your browser and confirm that it loads and functions as expected.

For customers running FCE 3.0, upgrading to FCE 3.1 remains the recommended approach.

If an immediate upgrade is not possible, PHP can be updated to the patched version 8.1.34-6.

Follow the same update process outlined for FCE 3.1, with the following changes:

• Replace php84 with php81 in commands and file paths.

• Replace references to PHP 8.4 with 8.1.

• Confirm that the installed PHP version is 8.1.34-6 or a later patched version.

• Depending on your installation, the PHP-FPM service may be named php81-php-fpm. Use the appropriate service name when restarting or checking its status.

Even after applying the PHP 8.1 security update, RecordPoint recommends upgrading to FCE 3.1 as soon as possible to ensure access to supported components, ongoing security updates and product improvements.

Customers who have upgraded from FCE 3.0 to FCE 3.1 may still have PHP 8.1 installed on their system.

If PHP 8.1 is no longer required, it can be disabled and removed.

Run the following command to identify any remaining PHP 8.1 packages:

If PHP 8.1 packages are listed, they may be remaining from the previous FCE 3.0 installation.

Before proceeding, confirm that FCE 3.1 is using PHP 8.4 and that no other applications depend on PHP 8.1.

Run:

This stops the PHP 8.1 service and prevents it from starting automatically.

Run:

Review the proposed package removals before confirming to ensure that no required components will be affected.

Once PHP 8.1 has been removed, verify that the application is operating normally.

Open the Diskover Web interface in your browser and confirm that it loads and functions as expected.

Note: PHP 8.1 should only be removed after confirming that the system has successfully upgraded to FCE 3.1 and that PHP 8.1 is no longer required.

Service availability: Restarting PHP-FPM and Nginx may cause a brief interruption to the FCE web interface. We recommend performing the update during a suitable maintenance window.

Scope of update: These instructions update the PHP components used by Diskover Web. Other components, including RabbitMQ and Elasticsearch, are not updated as part of this process.

Post-update validation: Customers should verify that the FCE web interface is functioning normally following the update.

If you require assistance with the security update or upgrading to FCE 3.1, please contact RecordPoint Support by raising a support ticket through the RecordPoint Support Portal.

Our Support team can assist with questions regarding the update process and recommended next steps.