CakePHP: Ubuntu patches 2016 flaw, but Legacy add-on required

Canonical released advisory USN-8978-1 on 3 November 2026, which fixes an IP spoofing vulnerability in CakePHP on Ubuntu 16.04 LTS. If you still manage PHP applications built on this framework running on Xenial servers, you need to know one thing before applying the update: the patch no longer ships with a standard Ubuntu Pro subscription.

The problem

According to the official advisory, Dawid Golunski discovered that CakePHP incorrectly trusted the HTTP CLIENT-IP header to determine the client's IP address, and a remote attacker could potentially exploit this flaw to spoof their IP address. This is CVE-2016-4793, not exactly a recent vulnerability: it carries a CVSS v3 severity score of 7.5 (high). If you use the client IP read by CakePHP for whitelisting, audit logging or anti-abuse controls, you have a real problem: the header can be forged with any HTTP request.

The corrected package is cakephp 2.8.0-1ubuntu0.1~esm1, available for Ubuntu 16.04 LTS (xenial).

The detail that matters: no standard ESM

This is where the advisory doesn't spell things out explicitly. Ubuntu 16.04 LTS exited the standard ESM window for Ubuntu Pro in April 2026: as of 30 April 2026, the ten-year ESM coverage for Ubuntu 16.04 LTS under Ubuntu Pro officially reached end of support. To continue receiving patches like this one, you need the next tier: Canonical offers an additional five years of maintenance and support through the Legacy add-on, layered on top of an active Ubuntu Pro subscription, which extends the total lifecycle to 15 years and ensures critical security patches until 2031.

In practice: if you still have production servers running 16.04 with CakePHP and a "base" Pro subscription, this package won't arrive automatically. Check your status with sudo pro status --all and, if needed, enable the Legacy add-on before planning the update.

Who needs to care

Anyone who migrated long ago to more recent releases (18.04 and later, where CakePHP 2.x is not vulnerable) is unaffected. The issue only concerns those running legacy applications on Xenial in production—not an uncommon scenario for internal business applications or websites that have never been updated since 2016.