Critical PHP vulnerabilities
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow remote code execution on any server that serves PHP. PHP released the fixes today in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Update your server in one of these ways:
- Press Patch in the PHP tab of your server
- Go to Manage β Updates and press Run now
- Follow https://ploi.io/documentation/server/how-do-i-updateupgrade-packages-on-my-server
The package builders are still catching up with demand. If your version isn't patched yet, try again later, or switch to packages.sury.org, which gets the builds first, and run the updates again:
wget -O php-patch.sh https://packages.sury.org/php/README.txt
chmod +x php-patch.sh
sudo ./php-patch.sh
Until then, this marketplace script turns off session.upload_progress.enabled. PHP lists it as a partial mitigation, not a fix: https://ploi.io/panel/marketplace/514-disable-session-upload-progress
PHP 8.1 and older get no official release. Upgrade those applications to PHP 8.4 or 8.5.