Dev {Tricks}

You are here: Home / Archives for Server and Hosting / Web Control Panel / aaPanel

by

Critical PHP security update for aaPanel users

SECURITY UPDATE · ACTION REQUIRED

On October 21, 2026, PHP fixed CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and may allow unauthenticated remote code execution.

Affected environments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php.

Fixed PHP versions

Patches are available for PHP 7.4 – 8.5 only. Please update to one of the following patched releases:

PHP branch Fixed release
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35
PHP 8.1 8.1.35
PHP 8.0 8.0.27
PHP 7.4 7.4.34

Update in aaPanel

1. Back up your websites, databases and configurations.
2. Open App Store → Installed. If needed, refresh Update App List. Update each PHP version in use to a fixed release when available.
3. Restart PHP services and verify that your websites work as expected.

Availability depends on your App Store. Users of PHP versions earlier than 7.4 should migrate to a supported release or confirm patches with their provider.

OpenLiteSpeed LSPHP update issue

Due to a script compatibility issue with OpenLiteSpeed, the current script supports LSPHP installation but not upgrades. Please use apt/yum to update LSPHP for now.

OpenLiteSpeed LSPHP update commands

CentOS / AlmaLinux / Rocky

yum update 'lsphp*' -y

Debian / Ubuntu

apt-get update
apt-get install --only-upgrade 'lsphp*' -y

Temporary mitigation

For specific CVE-2026-109619 attack paths only. The PHP official advisory recommends the settings below to block confirmed session attack paths and, on PHP 8.5, the fatal error backtrace path.

Open the affected PHP version’s Settings → Configuration file (php.ini) and set:

session.upload_progress.enabled = 0

For PHP 8.5, also set:

fatal_error_backtraces = 0

Restart all affected PHP workers. Settings must apply before request parsing; do not rely on ini_set() or PHP-FPM .user.ini.

These measures do not fix both vulnerabilities or replace security updates. They only address specific paths for CVE-2026-109619.

Node.js security updates

Node.js fixed 10 vulnerabilities, including four high-severity issues. Update to 22.23.4, 24.22.1 or 26.12.1.

Open Website → Node.js Project → Node version manager. Refresh the list and install a fixed release, then switch each project to it and restart.

Installing a new version alone does not update existing projects.

Official advisories

PHP security advisory   php.net

Node.js security releases   nodejs.org

by

How to Install Maldet and Run a Scan | Maldetect

Download the current version of maldet at https://www.rfxn.com/downloads/maldetect-current.tar.gz

wget https://www.rfxn.com/downloads/maldetect-current.tar.gz

Extract the downloaded file

tar -xvf maldetect-current.tar.gz

Go to the extracted directory

cd maldetect-1.6.5

Now install it

./install.sh

You done!

Maldet update command

maldet -u
maldet -d

Maldet Configuration Files

  • exec file: /usr/local/maldetect/maldet
  • exec link: /usr/local/sbin/maldet
  • exec link: /usr/local/sbin/lmd
  • cron.daily: /etc/cron.daily/maldet

How to USE maldet ?

Scan

maldet -a /path/to/scan

OR

maldet --scan-all /path/to/scan

View the scan report

maldet -e SCANID
maldet --report SCANID

How to setup Email Alert on Maldet?

vi /usr/local/maldetect/conf.maldet

 

 

 

 

by

How To Add Node.js Projects In aaPanel?

Go to App Store in the left sidebar.

Search and install Node.js Version Manager and PM2Manager.

Open Setting in PM2Manager.

Add and manage your Node.js projects

  • [Startup file] The startup file used to start the nodejs project, usually a js file
  • [Startup file] If npm is filled here, it means to start the project with npm run start
  • [Run Dir] The default run directory when running the project, usually the directory where the startup file is located
  • [Balance] Cluster mode. Some projects may not support it. When the number of instances is greater than 1, the cluster mode is enabled.
  • [Balance] After the cluster mode is enabled, load balancing will be performed automatically according to the number of instances

 

by

SSL Renew Error | aaPanel

  • after the latest update to 7.0.5 i’ve received errors when creating SSL from Let’s Encrypt in php projects:
  • cannot import name ‘_ED25519_KEY_SIZE’ from ‘cryptography.hazmat.primitives.asymmetric.ed25519’ (/www/server/panel/pyenv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/ed25519.py)

Solutions:

  1. Try restarting aaPanel and check.
  2. If it does not work, use the ssh tool to execute the following command: 
    btpip install -I cryptography==40.0.2
bt restart

It works like charm!
That’s All!.

by

Cannot Edit fstab as it is a Read-Only File

  1. How to edit read only fstab?
  2. How to edit /etc/fstab when system boots to read only file system?

Issue

/etc/fstab has been messed up. It is read-only now.

Tried

mount -o remount,rw /

Does not work

Solutions

mount -o remount,rw /dev/sda2 /

Note: Instead of /dev/sda2, use whatever the device is valid for your drive.