🔴 Critical PHP Security Update The PHP team will release a security update on Oct 21, 2026 at 14:00 UTC , fixing 2 critical vulnerabilities (CVSS 9.2): CVE-2026-109618 and CVE-2026-109619 . Please upgrade immediately once available. ⚠️ Take a server snapshot backup before upgrading (via your cloud provider). ℹ️ Patches are available for PHP 7.4 – 8.5 only. Please update to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, 8.1.35, 8.0.31 or 7.4.34 . 📌 How to update in aaPanel: Go to App Store Click Update App List (top-right) to refresh Find your PHP version and click Update 💡 If you have multiple PHP versions installed, update each one. aaPanel has line-by-line compared the official 7.4 patch and backported four fixed versions: The official release only provides patches for 8.2 and above — versions 7.0–7.3, 7.4, 8.0, and 8.1 receive nothing. 7.0.34 aaPanel patched build 7.1.34 aaPanel patched build 7.2.35 aaPanel patched build 7.3.34 aaPanel patched build All four versions are now updatable via the App Store . These versions no longer receive official PHP security maintenance — plan a migration to a supported version soon. If you cannot update PHP promptly, use the Nginx WAF plugin to block the PHP php2shell vulnerability Go to App Store to install/update Nginx WAF . ⚠️ If you're on older versions (5.6 or below), see the announcement below for mitigation. Please manually restart PHP after changing the configuration 🔗 Announcement: https://www.php.net/archive/2026.php#2026-10-20-1 If you are using OpenLiteSpeed , please first execute the command in the terminal to perform an update. CentOS / AlmaLinux / Rocky yum update 'lsphp*' -y if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Debian / Ubuntu : apt-get update apt-get install --only-upgrade 'lsphp*' -y if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Once the update is complete, please check the OpenLiteSpeed interface to verify that the PHP version has been updated to the patched version. RCE via OOM corruption (CVE-2026-109618) Set memory_limit=-1 , preferably in a way applications can't override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path. Set a low post_max_size . For applications that don't require file uploads, set post_max_size = 8M . If file uploads are necessary, set post_max_size = 32M . Keep upload_max_filesize below post_max_size . Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length . Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA , as these can cause the vulnerable allocation failure. RCE via stale global state (CVE-2026-109619) Set session.upload_progress.enabled=0 and restart every worker. Use php.ini , an FPM pool or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini . This blocks the confirmed session paths but not other variants. On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only. Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting , display_errors or @ does not help. Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.

PHP 8.4 Doesn't have any update released in the panel, please look into it.

aaP_thejosephmiller2000 Update the list in the top right corner and check if there is an update? Also check your php version

any solution? i use ubuntu 24, aapanel 8.0.7, current php 8.4.25 checking for ZLIB support... yes checking for zlib >= 1.2.11... yes checking whether to enable bc style precision math functions... yes checking for BZip2 support... no checking whether to enable calendar conversion support... no checking whether to enable ctype functions... yes checking for cURL support... yes checking for libcurl >= 7.61.0... yes checking for SSL support in libcurl... yes checking for curl_easy_perform in -lcurl... no configure: error: in '/www/server/php/84/src': configure: error: The libcurl check failed. See 'config.log' for more details make: *** No targets specified and no makefile found. Stop. Gracefully shutting down php-fpm warning, no pid file found - php-fpm is not running ? make: *** No rule to make target 'install'. Stop. ERROR: php-8.4.27 update failed. Please submit to https://forum.aapanel.com for help |-Successify --- Command executed! ---

One of your NODE went down? check this out. Make sure your nodes to fetch the latest php version are available. Thanks again.

itokupasi Is it ok to manually install dependencies and then update them? apt-get update apt-get install -y libcurl4-openssl-dev apt-get install -y libxml2-dev libsqlite3-dev libonig-dev libzip-dev libssl-dev if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); }

Traffic, download a lot of people, please be patient aaP_thejosephmiller2000

I am waiting for the 7.4 update

I noticed that a PHP update was available in aaPanel. After updating PHP 8.1, I found that PHP 8.1 is now displayed twice in the Software section. Both entries show the same PHP version and the official developer. I am not sure why the duplicate entry appeared after the update. My questions are: Why is PHP 8.1 showing twice after the update? Are these duplicate entries linked to the same PHP installation, or are they separate installations? Is this a known aaPanel bug? How can I safely remove the duplicate entry without affecting my websites or their PHP configurations? I host multiple production websites on this server, so I want to make sure everything remains stable. I have attached a screenshot showing both PHP 8.1 entries. Could someone from the aaPanel team please advise me on the correct solution? Thank you!

PHP 7.x: You need to compile using the source code from the official patch release. https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619

🔴 Critical PHP Security Update

myds

how to upgrade manual php 74?

aaP_edu5800

Hello everyone,

I'm currently using aaPanel 6.8.28 on CentOS 7, with PHP 7..4.33 installed.

I'd like to know if there are any known issues or compatibility problems when upgrading PHP 7.4.34 in this environment.

I would appreciate any recommendations or advice before proceeding with the upgrade.

Thank you!

aaP_fernandodacruz87

How do I do this on CentOS 7.9 with LiteSpeed? My PHP version is 8.3.9.

aaPanel_Kern

aaP_fernandodacruz87

Hello.

Sure, but OpenLiteSpeed should not have the update for CentOS 7.
Please check if the official website of OpenLiteSpeed has been updated. If not, it is recommended that you urge the OpenLiteSpeed team to carry out the update. https://rpms.litespeedtech.com/centos/7/x86_64/RPMS/

aaP_jadoyesabz

I have updated PHP 8.3 and PHP 7.4 as well, and I really appreciate your work on this.

However, I urgently need a patched version of PHP 7.0 as well.
This is absolutely critical for me.

aaPanel_Kern

aaP_jadoyesabz
[Important] Official patches ended for PHP 7.0–7.3 — use aaPanel builds

However, the official release only provides patches for 8.2 and above — versions 7.0–7.3, 7.4, 8.0, and 8.1 receive nothing.
aaPanel has line-by-line compared the official 7.4 patch and backported four fixed versions:

7.0.34 aaPanel patched build (test first recommended)
7.1.34 aaPanel patched build (test first recommended)
7.2.35 aaPanel patched build (test first recommended)
7.3.34 aaPanel patched build (test first recommended)

Install commands (choose the one that matches your version):
PHP 7.0:

sudo curl -o php7_cve.sh https://node.aapanel.com/install/php7_cve.sh && sudo bash php7_cve.sh install 70

PHP 7.1:

sudo curl -o php7_cve.sh https://node.aapanel.com/install/php7_cve.sh && sudo bash php7_cve.sh install 71

PHP 7.2:

sudo curl -o php7_cve.sh https://node.aapanel.com/install/php7_cve.sh && sudo bash php7_cve.sh install 72

PHP 7.3:

sudo curl -o php7_cve.sh https://node.aapanel.com/install/php7_cve.sh && sudo bash php7_cve.sh install 73

⚠️ Back up your sites and database before running.
⚠️ The upgrade will restart PHP, causing brief downtime on your sites — schedule it during off-peak hours.
⚠️ This is an aaPanel self-built patch; verify your business works in a test environment first.
⚠️ Take a server snapshot backup before upgrading (via your cloud provider).

aaP_riyad

Hello aaPanel Team,

Thank you for publishing the security announcement regarding the recent PHP vulnerabilities.

I want to clarify the PHP Security Patch Versions for OpenLiteSpeed**

I followed your instructions and updated my OpenLiteSpeed PHP packages using:

apt-get update
apt-get install --only-upgrade 'lsphp*' -y

I also installed all available PHP updates from the aaPanel App Store.

After updating, I noticed that some installed package versions do not match the patched versions listed in your announcement.

Here are the results from my server:

PHP 7.4: Installed version 7.4.33-21+jammy, while your announcement lists 7.4.34.
PHP 8.0: Installed version 8.0.30-21+jammy, while your announcement lists 8.0.27.
PHP 8.1: Installed version 8.1.34-21+jammy, while your announcement lists 8.1.35.
PHP 8.2: Installed version 8.2.35-1+jammy, matching your announcement.
PHP 8.3: Installed version 8.3.36-1+jammy, matching your announcement.
PHP 8.4: Installed version 8.4.27-1+jammy, matching your announcement.

I ran apt-get update again and checked the available PHP 8.1 package version. The result was:

Installed: 8.1.34-21+jammy
Candidate: 8.1.34-21+jammy

No newer lsphp packages are currently available through my configured APT repositories.

Could you please clarify the following?

Are the patched version numbers in your announcement correct for OpenLiteSpeed packages? In particular, should PHP 7.4 and PHP 8.1 be updated to 7.4.34 and 8.1.35 through the LiteSpeed repository?
Are my installed PHP 7.4, PHP 8.0 and PHP 8.1 packages protected against both vulnerabilities (CVE-2026-109618 and CVE-2026-109619), even though their version numbers differ from those listed in your announcement?
If the current packages do not contain the fixes, when will the patched OpenLiteSpeed packages become available, or what is the recommended update procedure?
Could you please confirm whether the versions listed in your announcement apply to both aaPanel-managed PHP installations and OpenLiteSpeed lsphp packages?

I want to ensure that my server is properly protected and avoid manually replacing PHP binaries or changing production configurations without a confirmed, compatible update.

Thank you for your time and clarification.

Server command output

1. PHP 8.1 package availability

Command:

apt-cache policy lsphp81 lsphp81-common

Output:

lsphp81:
  Installed: 8.1.34-21+jammy
  Candidate: 8.1.34-21+jammy
  Version table:
 *** 8.1.34-21+jammy 500
        500 http://rpms.litespeedtech.com/debian jammy/main amd64 Packages
        100 /var/lib/dpkg/status

lsphp81-common:
  Installed: 8.1.34-21+jammy
  Candidate: 8.1.34-21+jammy
  Version table:
 *** 8.1.34-21+jammy 500
        500 http://rpms.litespeedtech.com/debian jammy/main amd64 Packages
        100 /var/lib/dpkg/status

2. Available OpenLiteSpeed PHP upgrades

Command:

apt list --upgradable 2>/dev/null | grep -i lsphp

Output:

No lsphp package upgrades were listed.

3. Installed OpenLiteSpeed PHP package versions

Command:

dpkg-query -W -f='${Package} ${Version}\n' 'lsphp*'

Relevant output:

lsphp74 7.4.33-21+jammy
lsphp80 8.0.30-21+jammy
lsphp81 8.1.34-21+jammy
lsphp82 8.2.35-1+jammy
lsphp83 8.3.36-1+jammy
lsphp84 8.4.27-1+jammy

The package versions above are the installed versions reported by dpkg. After running apt-get update, no newer OpenLiteSpeed PHP package versions were available from my configured APT repositories.

aaPanel_Kern

aaP_riyad
Hello.

Please check if the official website of OpenLiteSpeed has been updated. If not, it is recommended that you urge the OpenLiteSpeed team to do so.
https://rpms.litespeedtech.com/

aaP_agusbintarto

Dear aaPanel Support Team,

Thank you for providing the security updates for older PHP versions.

We successfully updated our production PHP installation through the aaPanel App Store on October 23, 2026.

Our current environment:

Ubuntu 22.04
PHP CLI: 8.0.31
PHP-FPM: 8.0.31
Build date: October 23, 2026

Your security announcement lists PHP 8.0.27 as a patched version for CVE-2026-109618 and CVE-2026-109619.

Could you please confirm whether PHP 8.0.31 installed through aaPanel includes complete fixes for both CVEs?

We would also appreciate a changelog or patch reference for verification.

Thank you.

aaPanel_Kern

update to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, 8.1.35, 8.0.31 or 7.4.34

aaP_agusbintarto

aaPanel_Kern

myds
Hello.

Manually install the dependencies and then update - is it working properly?

yum install -y epel-release
yum install -y brotli-devel

aaP_geaputrix

Last version is 8.0.26, i wanna update to version 8.0.27 by following the instruction, first i update the app list then upgrade the PHP from app list, but why i get 8.0.31 version? Not 8.0.27 version like listed here? How to fix this?

aaPanel_Kern

aaP_geaputrix
Hello.
The correct version is 8.0.31.

boxhn.com

Thank you to the aaPanel team for your support and for taking the time to patch the previous versions. Quick, clear responses like this make a real difference for users who depend on aaPanel to run their servers. We appreciate the work you put into keeping the platform secure!

Lihasoft

I am waiting for the 5.6 update

aaPanel_Kern

Lihasoft
Hello.
It is not yet supported. If you are using Nginx WAF, you can try to update to block it.
Otherwise, you will have to adjust the parameters.

aaP_ts+aapanel

I managed to resolve my problem with updating PHP 7.4 by uploading my panelExec.log to Gemini. I had to manually install GCC compiler version 12 instead of using Ubuntu's default GCC version 14.

apt update apt install gcc-12 g++-12 -y

update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 100 update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 100

apt install libxml2-dev libsqlite3-dev libonig-dev libcurl4-openssl-dev libpng-dev libwebp-dev libvpx-dev libjpeg-dev libfreetype6-dev perl -y

Then update via aaPanel...

Optional: switch GCC compiler back to version 14
update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-14 110 update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-14 110

check GCC version
gcc --version

quick switch between installed versions
update-alternatives --config gcc update-alternatives --config g++

Lihasoft

aaPanel_Kern Sad that there’s no version for PHP 5.6

Sunny007

Hello,

I am running aaPanel on Debian 11 with PHP 7.4 for my Discuz! X3.4 website.

On October 23, 2026, I updated PHP through aaPanel, and the installed version is now PHP 7.4.34. The reported build date is October 23, 2026.

Could you please confirm whether this specific PHP 7.4.34 build includes the security fixes for CVE-2026-109618 and CVE-2026-109619?

I have temporarily disabled my website as a precaution. I would like to know whether it is safe to re-enable it with this PHP build, or whether I should wait for another update.

Thank you.

aaPanel_Kern

Sunny007
Yes
Please update to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, 8.1.35, 8.0.31 or 7.4.34.

« Previous Page Next Page »