PHP security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)

Saragoldfarb · October 21

The world didn't end. I think we're good.

tarisu · October 21

Did virtualizor patched the issue?

dustinc · October 21

As a heads up - unlike a traditional PHP update, CloudLinux backported the fix into its php packages. This means the version number may be below PHP's, despite being patched.

How to confirm the fix

Our packages carry the fix as a backport, so their version numbers stay below PHP's (for example, ea-php84 is 8.4.26, not 8.4.27). Look for the CVE IDs in the package changelog instead:
rpm -q ea-php84-php-cli --changelog | grep -E "CVE-2026-(109618|109619)"

dustinc · October 21

@tarisu said:
Did virtualizor patched the issue?

We do not use Virtualizor - but yes, it appears that Virtualizor emps was updated a few hours ago (still uses php 7.4, but includes the backport fixes for PHP2Shell): https://www.virtualizor.com/blog/virtualizor-3-3-0-launched-patch-5/

MannDude · October 22

@dustinc said:

@tarisu said:
Did virtualizor patched the issue?

We do not use Virtualizor - but yes, it appears that Virtualizor emps was updated a few hours ago (still uses php 7.4, but includes the backport fixes for PHP2Shell): https://www.virtualizor.com/blog/virtualizor-3-3-0-launched-patch-5/

We still got older legacy VMs on virtualizor. Pushed their update, it just broke virtualizor.

Updater stalled at 80%. After about ten minutes stuck there I check elsewhere in the panel and everything just 503's now.

Probably safer it's all broken and inaccessible at the moment anyway.

georgedatacenter · October 22

@MannDude said:

@dustinc said:

@tarisu said:
Did virtualizor patched the issue?

We do not use Virtualizor - but yes, it appears that Virtualizor emps was updated a few hours ago (still uses php 7.4, but includes the backport fixes for PHP2Shell): https://www.virtualizor.com/blog/virtualizor-3-3-0-launched-patch-5/

We still got older legacy VMs on virtualizor. Pushed their update, it just broke virtualizor.

Updater stalled at 80%. After about ten minutes stuck there I check elsewhere in the panel and everything just 503's now.

Probably safer it's all broken and inaccessible at the moment anyway.

Yeah, that's how it is with Virtualizor. That panel is garbage.

MannDude · October 22

@georgedatacenter said:

@MannDude said:

@dustinc said:

@tarisu said:
Did virtualizor patched the issue?

We do not use Virtualizor - but yes, it appears that Virtualizor emps was updated a few hours ago (still uses php 7.4, but includes the backport fixes for PHP2Shell): https://www.virtualizor.com/blog/virtualizor-3-3-0-launched-patch-5/

We still got older legacy VMs on virtualizor. Pushed their update, it just broke virtualizor.

Updater stalled at 80%. After about ten minutes stuck there I check elsewhere in the panel and everything just 503's now.

Probably safer it's all broken and inaccessible at the moment anyway.

Yeah, that's how it is with Virtualizor. That panel is garbage.

Yep. I guess after I catch my breath after this week I'll prioritize finalizing the migrations I started well over a year ago...

JasonM · October 22

thanks my host here just updated to latest CL and its patched.

gbzret4d · October 22

Man I got so many emails....200+ unread all compared to this vulnerabilities

TrK · October 22

I would say cloudpanel was the slowest to release the updates. Now time to go through each and every server to cross check the php runtime updates and phpini checks for older versions.

hyperblast · October 22

I think this information would also be appropriate here in a central location:

@MikeA confirmed extravm has patched php - https://lowendtalk.com/discussion/comment/4894332/#Comment_4894332

3K33 · October 22

@MannDude said:

@dustinc said:

@tarisu said:
Did virtualizor patched the issue?

We do not use Virtualizor - but yes, it appears that Virtualizor emps was updated a few hours ago (still uses php 7.4, but includes the backport fixes for PHP2Shell): https://www.virtualizor.com/blog/virtualizor-3-3-0-launched-patch-5/

We still got older legacy VMs on virtualizor. Pushed their update, it just broke virtualizor.

Updater stalled at 80%. After about ten minutes stuck there I check elsewhere in the panel and everything just 503's now.

Probably safer it's all broken and inaccessible at the moment anyway.

Just tried upgrading, it’s not signed properly and fails now. What a piece of shit software, need to move out from it already.

Daniel15 · October 22

@Levi said:
Sury (debian and ubuntu) repo released backports for php 7.x. Though, cant find changelog for it.

Changelog is in the package and is available using apt changelog, or in /usr/share/doc/ after installing it, same as every Debian package. I'm not sure if he also pulls the news and changelog files onto his site somewhere.

You can also install apt-listchanges to see major changes (and have them emailed to you) when installing updates.

DediRock · October 22

@neighhouse said:

@DediRock said:

@neighhouse said:
@NDTN cancel your meet with FAT32 and get patching my beloved.

You too cuties @DediRock.

And then calm our nerves by telling us you did.

lol @neighhouse we definitely got the patch installed this am.

Absolute goats.

Thank you @neighhouse

mrapino · October 22

@DataWagon

barbarza · October 22

Has LET been secured @angstrom ? We can’t have anything happening here…

angstrom · October 22

@barbarza said:
Has LET been secured @angstrom ? We can’t have anything happening here…

Although I'm not in a position to verify this directly, I've been reliably informed that yes, the version of PHP that LET runs on has received the latest patch, so all is good in this respect

Saragoldfarb · October 22

@angstrom said:

@barbarza said:
Has LET been secured @angstrom ? We can’t have anything happening here…

Although I'm not in a position to verify this directly, I've been reliably informed that yes, the version of PHP that LET runs on has received the latest patch, so all is good in this respect

Thank you Mr . @strongarm !

JoshR · October 23

Round 2!
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html?m=1

rpqu · October 23

@JoshR said:
Round 2!
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html?m=1

Fuck

woinokiz · October 23

Php, java , node ,

What's remaining now?

Jord · October 23

@woinokiz said:
Php, java , node ,

What's remaining now?

We're going to hell in a handcart

woinokiz · October 23

@Jord said:

@woinokiz said:
Php, java , node ,

What's remaining now?

We're going to hell in a handcart

Ok I just got info that Ruby also got involved

Jord · October 23

@woinokiz said:

@Jord said:

@woinokiz said:
Php, java , node ,

What's remaining now?

We're going to hell in a handcart

Ok I just got info that Ruby also got involved

Zombies next

rpqu · October 23

@Jord said:

@woinokiz said:

@Jord said:

@woinokiz said:
Php, java , node ,

What's remaining now?

We're going to hell in a handcart

Ok I just got info that Ruby also got involved

Zombies next

I think this thread should be changed to CVE general or something

angstrom · October 23

@JoshR said:
Round 2!
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html?m=1

But just to keep things in perspective and to remain sober:

We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.

See https://www.php.net/archive/2026.php#2026-10-23-1

nem · October 23

Bear in mind that setting is useless if you're running PHP-FPM or OLS. It should've been yanked or at least disabled at configure time.

MikeA · October 23

@nem said:
Bear in mind that setting is useless if you're running PHP-FPM or OLS. It should've been yanked or at least disabled at configure time.

After the past LSWS vulnerabilities and LiteSpeed Tech withholding patches from OLS, ditching OLS last month has been a great decision.

forest · October 24

@woinokiz said:
Php, java , node ,

What's remaining now?

We need to go back to Perl.

woinokiz · October 24

@forest said:

@woinokiz said:
Php, java , node ,

What's remaining now?

We need to go back to Perl.

@woinokiz said:

@Jord said:

@woinokiz said:
Php, java , node ,

What's remaining now?

We're going to hell in a handcart

Ok I just got info that Ruby also got involved

Python also got involved

Howdy, Stranger!

Categories

In this Discussion

PHP security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

PHP security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)

Comments