All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
aaPanel: Critical PHP & Node.js Security Updates
aaPanel_team
Member, Patron Provider
aaPanel Security Notice: PHP and Node.js Updates
Critical PHP Security Update
On October 21, 2026, PHP fixed CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and may allow unauthenticated remote code execution.
Affected environments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for Apache mod_php.
PHP Versions and Patch Availability
The latest official PHP releases containing the fixes are:
| PHP branch | Official patched release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
For the older branches listed below, the PHP team has made source code available through GitHub without providing prebuilt packages. aaPanel is handling the packaging of these patched builds.
These are aaPanel-provided patched builds and should not be confused with new official upstream releases.
| PHP branch | aaPanel patched build | Status |
|---|---|---|
| PHP 7.4 | 7.4.34 | Available through aaPanel |
| PHP 8.1 | 8.1.35 | Available through aaPanel |
| PHP 8.0 | 8.0.27 | Still undergoing testing; not yet available for deployment |
Availability may vary depending on your aaPanel App Store. Please refresh the application list to check for updates.
PHP Versions Earlier Than 7.4
aaPanel plans to publish updated configuration guidance tomorrow for PHP versions earlier than 7.4. WAF rules will also be updated to help block related attacks.
These configuration changes and WAF rules are mitigation measures, not replacement security patches. Users of older PHP versions should migrate to a supported release or confirm patch availability with their provider.
How to Update PHP in aaPanel
- Back up your websites, databases and configurations.
- Open App Store > Installed.
- If necessary, click Update App List to refresh available releases.
- Update every PHP version in use to the corresponding patched release or aaPanel-provided build when available.
- Restart the affected PHP services and verify that your websites work as expected.
PHP 8.0 users: The aaPanel patched build is still being tested. Please follow the official forum for its release status.
OpenLiteSpeed LSPHP Update Issue
Due to a script compatibility issue with OpenLiteSpeed, the current aaPanel script supports LSPHP installation but not upgrades.
For now, update existing LSPHP installations using your system package manager.
CentOS / AlmaLinux / Rocky Linux
yum update 'lsphp*' -y
Debian / Ubuntu
apt-get update
apt-get install --only-upgrade 'lsphp*' -y
After updating, restart the affected services and verify that your websites work correctly.
Temporary Mitigation
The following settings address specific attack paths for CVE-2026-109619 only. They do not fix both vulnerabilities or replace security updates.
The PHP official advisory recommends these settings to block confirmed session attack paths and, on PHP 8.5, the fatal error backtrace path.
For each affected PHP version, open Settings > Configuration file (php.ini) and set:
session.upload_progress.enabled = 0
For PHP 8.5, also set:
fatal_error_backtraces = 0
Restart all affected PHP workers after saving the changes.
These settings must take effect before request parsing. Do not rely on ini_set() or PHP-FPM .user.ini files to apply these mitigations.
Node.js Security Updates
Node.js fixed 10 vulnerabilities, including four high-severity issues.
Update to one of the following fixed releases:
- 22.23.4
- 24.22.1
- 26.12.1
How to Update Node.js in aaPanel
- Open Website > Node.js Project > Node version manager.
- Refresh the version list.
- Install a fixed release appropriate for your projects.
- Switch each project to the updated Node.js version.
- Restart each project and verify that it works correctly.
Installing a new Node.js version alone does not update existing projects. Each project must be switched to the new version and restarted.
Further Updates
aaPanel will continue to monitor these security issues and provide updates on PHP 8.0 testing, configuration guidance for older PHP versions and WAF rule changes.
Please follow the official aaPanel forum for release availability and further security updates.
Comments
Are vibe coders gonna do this?
LOL LMAO
The company has been around for 9 years.
Wishing your project all the best and hoping everything goes smoothly.
Thank you; I hope everything goes smoothly for everyone.
[Important] Official Patch Support Has Ended for PHP 7.0–7.3 — Use aaPanel Patched Builds
The official release provides patches only for PHP 8.2 and later. PHP 7.0–7.3, 7.4, 8.0, and 8.1 do not receive these patches.
After reviewing the official PHP 7.4 patch line by line, aaPanel has backported the fixes to the following four builds:
Installation commands
Run the command that matches your PHP version.
PHP 7.0:
PHP 7.1:
PHP 7.2:
PHP 7.3:
Before upgrading
Mentally strong people rework the website to run in latest PHP versions, not relying on backports.
We are doing this to make it available to users who need older versions.
Time to use the Sury repo (at least for Debian/Ubuntu deployments)?...
This is worth exploring.
The mentally weak should do that too.
Perhaps the problems with PHP are temporary and things will get better once all the old flaws get fixed, AI will at some point run out of old flaws to find and the problem seems to be old flaws.
People will make more problems, but I suppose this could reduce significantly due to AI.
If you are using Sury. Block telemetry.sury.org as it sends the package name, its version and a timestamp with no opt-out.
It wouldn't bother me~ they have the pull logs anyway.
Not the point. The point is that they did it and didn't mention it and didn't include an opt out.
That's an unreliable way to collect data, not fit for purpose. Much harder for them to do also. Distributed system, logs spread over several servers, less detail.
Blocking telemetry is the right thing to do.