jfoc Upcoming Critical PHP Security Release CVE-2026-109618 & CVE-2026-109619 https://www.php.net/archive/2026.php#2026-10-20-1 we will get the update asap when the patches available?
aaP_vilius Hello, this is quite important CVE and a lot of our systems uses aaPanel. How can we except get update? Do we need to first update aaPanel version to get update or update AppStore and update PHP version from there?
aaPanel_Kern After we update the PHP version, If you click Update App List in the App Store, you will see an update message for that app aaP_vilius
aaP_joerivdvelden aaPanel_Kern Please let us know as soon as the PHP update is available on the app store. Seems updating just not only pulled in the still vulnerable 8.2.34.
aaPanel_Kern Check out the post for updates: https://www.aapanel.com/forum/d/26249-critical-php-security-update ⚠️ Take a server snapshot backup before upgrading (via your cloud provider). ℹ️ Patches are available for PHP 8.2 – 8.5 only. Please update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. 📌 How to update in aaPanel: Go to App Store Click Update App List (top-right) to refresh Find your PHP version and click Update 💡 If you have multiple PHP versions installed, update each one. ⚠️ If you're on older versions (8.1 or below), see the announcement below for mitigation. 🔗 Announcement: https://www.php.net/archive/2026.php#2026-10-20-1 aaP_lukas minefc tbare aaP_titanyusfi123 aaP_cedric.buono aaP_sub2unlocksofficial aaP_sub2unlocksofficial aaP_Me65 tourtools aaP_by_raizo aaP_titanyusfi123 aaP_dinamasdot aaP_mediaplus_ma tbare jsterr aaP_tyzrj766 tbare dudubroering
entegreturk Thanks for the updates on supported versions. For those of us with legacy apps on PHP 8.1 and below, will aaPanel provide manual patches or backported packages for these EOL versions? Any guidance would be greatly appreciated.
tbare entegreturk While it may not be possible, I'd strongly recommend getting up to something that patches this. there are instructions on what you can do in configs on php.net if you can't update, though.
tbare Is it reasonable to compile this ourselves, or will / could that break future aaPanel "App Store" updates? I have PHP disabled / sites paused on my hosts until this patch is released.
aaP_dinamasdot hi @aaPanel_Kern it was already update on app store for this CVE for vulnerabilities that can allow unauthenticated remote code execution ?
