New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
PHP security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)
angstrom
Moderator, Veteran
This seems worthy of an announcement:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Thanked by 14monsoon73 itzsenu oloke Murv zGato JohnnySac stupidgenius rpqu mrerenk jsg BasToTheMax commercial tux tzuli
Comments
First.
Hosts, please tell me that you have patched your whmcs. Please....
Debian/Ubuntu/Archlinux/Almalinux all have the patch out already.
@NDTN cancel your meet with FAT32 and get patching my beloved.
You too cuties @DediRock.
And then calm our nerves by telling us you did.
@jbiloh have you patched LET yet?
On the linked page, they also write (with corresponding links):
Since these versions are EOL, this should be regarded as a best-effort attempt
fck, cloudpanel haven't release their php update yet
PHP-based billing panels:
What hackers can do:
PHP-based hypervisor panels:
What hackers can do:
PHP-based shared hosting panels:
What hackers can do:
These panels are not PHP based:
You can escape PHP vulnerabilities, but they can have their own vulnerabilities.
Research performed by Muse.ai, "what hackers can do" sections written by the flesh.
@bdspice take note
Looks like Virtualizor/Softaculous shut down their websites.
virtualizor emps runs on php 7.4
I saw remi repo released patched version, but cdn hasn't updated yet. Brought down my php service for now.
Sury (debian and ubuntu) repo released backports for php 7.x. Though, cant find changelog for it.
lol @neighhouse we definitely got the patch installed this am.
Absolute goats.
Please, that guy even patched 5.6
Ondřej is cool.
Yep, that guy is goat’ed af.
No love for php-4.4 users? (Or is php-4.4 not affected?)
No love for PHP 6.0 either.
In 2008, I called up a shared hosting reseller asking whether they have PHP 4 or PHP 5, and I was told it’s “PHP 6”.
Insert php-selektor joke.
I saw an ad for a php developer at Pornhub the other day. It was really attractive but I don't know if I could bring myself to admit before my friends and family that I do php
@FAT32 you should update all idlers, if there are php installed
@dustinc Shared hosting still runs unpatched, how can this be?
Hi @tomle -- You'll find this to be the case for anyone running CloudLinux, which is almost every shared hosting provider nowadays. We're waiting on CloudLinux for the patched packages. All of our shared hosting servers run CloudLinux 9, where the ea-php* packages are supplied through CloudLinux's repositories. We're closely following their rollout here: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
We've been watching this very closely since yesterday, and have already implemented PHP configuration mitigations across all shared hosting servers -- including the recommended php.ini changes. All of our shared hosting servers also use cPGuard, and we now have its additional WAF protection in place. These rules are designed to inspect incoming multipart request headers and block known malicious patterns before they reach the PHP parser. More information on that here: https://www.opsshield.com/blog/php2shell-critical-vulnerabilities-cve-2026-109618-cve-2026-109619-mitigation-steps-and-cpguard-waf-protection/
These protections help reduce exposure in the meantime, and we're actively monitoring the repositories and are ready to apply the updates as soon as CloudLinux makes them available.
Thanks for addressing it so quickly.
Hi @tomle -- no worries! Things are progressing based on CloudLinux's latest status update, though we're still waiting on the ea-php* packages. We've been in communication with their team, and they've told us they're actively working on these and targeting a release today.
Looking at the cPanel forums too, other CloudLinux users appear to be in the same boat, waiting for those updates too.
In the meantime, we have multiple layers of mitigation in place across our shared/reseller hosting servers, with most of these measures already in place since yesterday (well before any exploit script or PoC dropped). As @Daniel15 also touched on here, Apache environments appear to carry the highest risk. For context, all of our shared hosting servers run LiteSpeed Enterprise, and LiteSpeed has been very responsive throughout this entire ordeal as well. We've appreciated that from them.
As I'm sure you can imagine, it's likely very much all hands on deck over at CloudLinux right now and I have no doubt that they are very much on it. We're staying in touch with their team, closely monitoring the releases, and applying the patches as they become available.
Woot woot, CloudLinux ea-php* packages rolling out now as of ~4 minutes ago
https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
Huh...today I learned something new. I thought any PHP fix would come from cPanel but I guess there's CloudLinux + hardened-PHP in which case you get the fix from CloudLinux.
I thought CloudLinux was just a special kernel/distro that had special features for per-account isolation but I guess they reach much further up the stack than I'd thought.
Yeah they took their time
I was also waiting whole day
They are a company focused on shared-hosting and as a result - hardened RHEL distro.
All the downstream packages are obviously built by them, this is also why the bug bounty
for compromising it is much higher than regular vanilla distros.