Upcoming Critical PHP Security Release CVE-2026-109618 & CVE-2026-109619 https://www.php.net/archive/2026.php#2026-10-20-1 we will get the update asap when the patches available?

Hello. Thank you for your feedback. We will update you in due course jfoc

Hello, this is quite important CVE and a lot of our systems uses aaPanel. How can we except get update? Do we need to first update aaPanel version to get update or update AppStore and update PHP version from there?

After we update the PHP version, If you click Update App List in the App Store, you will see an update message for that app aaP_vilius

Will there be an update on this thread, or anywhere, once the patch is available?

Im also waiting for the patch, the CVEs will drop in about 15 minutes.

https://www.php.net/archive/2026.php#2026-10-21-5 its already out

Thanks for the updates on supported versions. For those of us with legacy apps on PHP 8.1 and below, will aaPanel provide manual patches or backported packages for these EOL versions? Any guidance would be greatly appreciated.

entegreturk While it may not be possible, I'd strongly recommend getting up to something that patches this. there are instructions on what you can do in configs on php.net if you can't update, though.

Upcoming Critical PHP Security Release CVE-2026-109618 & CVE-2026-109619

aaPanel_Kern

If not, update again
It could be caching

tbare

tourtools

Because the vulnerabilities are so severe, the PHP security team has also released minimal source backports for PHP 7.4, 8.0 and 8.1.
It would be great to have also these

aaPanel_Kern

tourtools
We will update these outdated versions in the future

aaP_lukas

@aaPanel_Kern i installed it twice. Version is still 8.4.26

aaP_lukas

aaP_lukas After Panel restart and one more update it worked

ljcool2006

Are the download servers currently overloaded? Right now I am getting speeds slower than dial-up when I try to update PHP.

tourtools

https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619
https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619

tbare

I forced it using the php.sh update that aaP_mail56 posted:
I opened /www/server/panel/install/php.sh and edited the targeted version string from 8.3.35 to 8.3.36.

trying again, and it's taking forever to download, but i get it.

aaP_jakus

aaPanel_Kern

Please do it as soon as possible, I have lots of Servers that run on 7.3 PHP but I tend to Update to 7.4 PHP since they fixed those issues, please do it and let me know!

I tend to use AAPanel Version since 3 years ago (and I did not update AAPanel) hopefully I can update from 7.3 PHP to 7.4 PHP via AAPanel Dashboard or atleast manually by code via terminal,

Please do it,

Thanks.

tourtools

aaPanel_Kern thank you, I hope no later than this week or the beginning of next week.
The most critical moment is right now.

aaP_malashenko.mars

aaP_jakus

aaPanel_Kern

Hi Kern, will you be adding a fix for 7.4?
https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4fc3c2c375f42b90aa2

tbare

Is there a reason you don't source these from the official php repo? seems like coming from https://download.bt.cn/src/php-8.3.36.tar.gz is taking its sweet time...

aaP_danilhamsik

Hi, I'm trying to update, but it's completely stopped. Is this a problem with the aaPanel download server, or do I need to do something?

aaPanel_Kern

Traffic, download a lot of people, please be patient

aaP_danilhamsik

aaP_jakus

Please do add fix for 7.4!

aaP_animestarsorg

config.status: executing main/internal_functions.c commands
config.status: executing main/internal_functions_cli.c commands
config.status: executing default commands

+--------------------------------------------------------------------+
| License: |
| This software is subject to the PHP License, available in this |
| distribution in the file LICENSE. By continuing this installation |
| process, you are bound by the terms of this license agreement. |
| If you do not agree with the terms of this license, you must abort |
| the installation process at this point. |
+--------------------------------------------------------------------+

Thank you for using PHP.

configure: WARNING: unrecognized options: --with-iconv-dir, --with-libxml-dir, --enable-inline-optimization, --with-xmlrpc
make: *** No rule to make target '/www/server/php/84/src/Zend/zend.h', needed by 'ext/opcache/shared_alloc_mmap.lo'. Stop.
Gracefully shutting down php-fpm . done

make: *** No rule to make target '/www/server/php/84/src/Zend/zend.h', needed by 'ext/opcache/shared_alloc_mmap.lo'. Stop.

ERROR: php-8.4.27 update failed.
Please submit to https://forum.aapanel.com for help
|-Successify --- Command executed! ---

I encountered this error while updating to version 8.4.26. I’ve since restarted, and everything seems fine now—but would it be better to reinstall it, just in case?

tourtools

I can see updates for 7.4, 8.0 and 8.1. You're the best. Really really thank you!

« Previous Page