Security

SECURITY UPDATE · ACTION REQUIRED

On October 21, 2026, PHP fixed CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and may allow unauthenticated remote code execution.

Affected environments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php.

Fixed PHP versions

Patches are available for PHP 7.4 – 8.5 only. Please update to one of the following patched releases:

PHP branch	Fixed release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1	8.1.35
PHP 8.0	8.0.27
PHP 7.4	7.4.34

Update in aaPanel

Back up your websites, databases and configurations.

Open App Store → Installed. If needed, refresh Update App List. Update each PHP version in use to a fixed release when available.

Restart PHP services and verify that your websites work as expected.

Availability depends on your App Store. Users of PHP versions earlier than 7.4 should migrate to a supported release or confirm patches with their provider.

OpenLiteSpeed LSPHP update issue

Due to a script compatibility issue with OpenLiteSpeed, the current script supports LSPHP installation but not upgrades. Please use apt/yum to update LSPHP for now.

OpenLiteSpeed LSPHP update commands

CentOS / AlmaLinux / Rocky

yum update 'lsphp*' -y

Debian / Ubuntu

apt-get update

apt-get install --only-upgrade 'lsphp*' -y

Temporary mitigation

For specific CVE-2026-109619 attack paths only. The PHP official advisory recommends the settings below to block confirmed session attack paths and, on PHP 8.5, the fatal error backtrace path.

Open the affected PHP version’s Settings → Configuration file (php.ini) and set:

session.upload_progress.enabled = 0

For PHP 8.5, also set:

fatal_error_backtraces = 0

Restart all affected PHP workers. Settings must apply before request parsing; do not rely on ini_set() or PHP-FPM .user.ini.

These measures do not fix both vulnerabilities or replace security updates. They only address specific paths for CVE-2026-109619.

Node.js security updates

Node.js fixed 10 vulnerabilities, including four high-severity issues. Update to 22.23.4, 24.22.1 or 26.12.1.

Open Website → Node.js Project → Node version manager. Refresh the list and install a fixed release, then switch each project to it and restart.

Installing a new version alone does not update existing projects.

Official advisories

PHP security advisory php.net

Node.js security releases nodejs.org