On 21 October 2026 the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They can allow an attacker to run code on a server without logging in, through any PHP that serves websites: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP.
Status at MMITech
- Our infrastructure, including the Plesk web hosting servers and our own websites, has been updated and patched.
- Servers of customers with a managed server contract have also been updated.
- Web hosting and managed server customers do not need to take any action.
Unmanaged VPS and dedicated server customers
The software on these servers is maintained by you, so we cannot update it for you. If PHP runs on your server, please update it as soon as possible.
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, or a distribution package that includes the fix.
How to update:
- Ubuntu / Debian:
sudo apt update && sudo apt upgrade, then restart PHP-FPM and/or Apache. - ondrej/php PPA: if you ever upgraded Ubuntu to a new release (for example 22.04 to 24.04), check that the PPA is still enabled. Release upgrades disable it, and PHP then silently stops receiving updates. Re-add it with:
sudo add-apt-repository ppa:ondrej/php - AlmaLinux / Rocky with the Remi repository: check that Remi has published the fixed packages before relying on it.
- Plesk: Tools & Settings > Updates, then update the PHP versions in use.
- Docker: rebuild your PHP images with
docker compose build --pull, then recreate the containers. Restarting alone keeps the old PHP. - PHP 8.1 or older: no longer receives official fixes. Please move to PHP 8.2 or newer.
How to check: the PHP that serves your websites can differ from the command line one. Check the FPM version too, for example php-fpm8.3 -v (or a phpinfo() page).
If you cannot update today: set session.upload_progress.enabled = 0 in php.ini and restart all PHP workers. This only reduces the risk; updating is the only real fix.
Full advisory: php.net
If you need help, please open a support ticket.
