Dev {Tricks}

You are here: Home / Archives for Server and Hosting / Security

by

Critical PHP security update for aaPanel users

SECURITY UPDATE · ACTION REQUIRED

On October 21, 2026, PHP fixed CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and may allow unauthenticated remote code execution.

Affected environments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php.

Fixed PHP versions

Patches are available for PHP 7.4 – 8.5 only. Please update to one of the following patched releases:

PHP branch Fixed release
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35
PHP 8.1 8.1.35
PHP 8.0 8.0.27
PHP 7.4 7.4.34

Update in aaPanel

1. Back up your websites, databases and configurations.
2. Open App Store → Installed. If needed, refresh Update App List. Update each PHP version in use to a fixed release when available.
3. Restart PHP services and verify that your websites work as expected.

Availability depends on your App Store. Users of PHP versions earlier than 7.4 should migrate to a supported release or confirm patches with their provider.

OpenLiteSpeed LSPHP update issue

Due to a script compatibility issue with OpenLiteSpeed, the current script supports LSPHP installation but not upgrades. Please use apt/yum to update LSPHP for now.

OpenLiteSpeed LSPHP update commands

CentOS / AlmaLinux / Rocky

yum update 'lsphp*' -y

Debian / Ubuntu

apt-get update
apt-get install --only-upgrade 'lsphp*' -y

Temporary mitigation

For specific CVE-2026-109619 attack paths only. The PHP official advisory recommends the settings below to block confirmed session attack paths and, on PHP 8.5, the fatal error backtrace path.

Open the affected PHP version’s Settings → Configuration file (php.ini) and set:

session.upload_progress.enabled = 0

For PHP 8.5, also set:

fatal_error_backtraces = 0

Restart all affected PHP workers. Settings must apply before request parsing; do not rely on ini_set() or PHP-FPM .user.ini.

These measures do not fix both vulnerabilities or replace security updates. They only address specific paths for CVE-2026-109619.

Node.js security updates

Node.js fixed 10 vulnerabilities, including four high-severity issues. Update to 22.23.4, 24.22.1 or 26.12.1.

Open Website → Node.js Project → Node version manager. Refresh the list and install a fixed release, then switch each project to it and restart.

Installing a new version alone does not update existing projects.

Official advisories

PHP security advisory   php.net

Node.js security releases   nodejs.org

by

How to Install Maldet and Run a Scan | Maldetect

Download the current version of maldet at https://www.rfxn.com/downloads/maldetect-current.tar.gz

wget https://www.rfxn.com/downloads/maldetect-current.tar.gz

Extract the downloaded file

tar -xvf maldetect-current.tar.gz

Go to the extracted directory

cd maldetect-1.6.5

Now install it

./install.sh

You done!

Maldet update command

maldet -u
maldet -d

Maldet Configuration Files

  • exec file: /usr/local/maldetect/maldet
  • exec link: /usr/local/sbin/maldet
  • exec link: /usr/local/sbin/lmd
  • cron.daily: /etc/cron.daily/maldet

How to USE maldet ?

Scan

maldet -a /path/to/scan

OR

maldet --scan-all /path/to/scan

View the scan report

maldet -e SCANID
maldet --report SCANID

How to setup Email Alert on Maldet?

vi /usr/local/maldetect/conf.maldet

 

 

 

 

by

How to change the SSH port | WHM

How to change the SSH port

  • Log in to the server with root user
  • Open /etc/ssh/sshd_config. 
    vi /etc/ssh/sshd_config
  • Edit the port line. Change the default port 22 to your choice, for example 1234. 
    port 1234
  • Restart SSHD 
    /scripts/restartsrv_sshd
  • Test SSH while specifying the new port 
    ssh USER@HOSTNAME -p1234
  • Please use your USER and HOSTNAME and the new port
  • If unsuccessful, add the new SSH port to your firewalls and then retest.
  • If the SSH test on the new port is successful then you can reboot and log in to the server with new port.

 

by

How to disable functions using the PHP disable_functions directive in php ini

  • PHP disable_functions Executable Handling

The disable_function is used to stop certain dangerous PHP functions from executing.

Example of disable_function.

disable_functions = "exec, system"

Use the disable_functions directive in php.ini file to disable specific functions.
At least disable exec(), shell_exec() and system(). (If using WordPress).

disable_functions = "exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, parse_ini_file, show_source"

 

by

Missing vmail Folders .Sent, .Trash, .Drafts, .Junk, and Other

  • Missing Sent, Trash, Drafts, Junk, and Other Folders

Solution: Check whether the dot files are hidden. Make the dot files to show.

Horde

  • Click on the Folder Actions option.
  • Choose the Rebuild Folder List option.
  • Then choose the Show All Mailboxes option.

Roundcube

  • Go to Settings.
  • Click Folders.
  • Re-subscribe to each folder by clicking the check box.

Windows Mail

  • Click IMAP Folders.
  • In the Show/Hide IMAP Folders dialog box, select a folder.
  • Click Show.

Thunderbird

  • In the Folder pane, look for IMAP mail and right-click on it.
  • Go to Settings, click on Server Settings, then select Advanced.
  • Remove the checkmark on Show only Subscribed folders.
  • Click OK.

Microsoft Outlook Express

  • Under Folders on the left side of the screen, select the inbox for your email (NOT the one under Local Folders).
  • Click the Tools menu, then select IMAP Folders.
  • Select the desired folder(s).
  • Click Show.
  • Click OK.