Adil Elsaeed
Software engineer

CVE-2026-109618 & CVE-2026-109619: How to Fix Critical PHP RCE in CloudPanel

TL;DR

On October 21, 2026, the PHP core team released emergency patches for two critical Remote Code Execution vulnerabilities rated 9.2 / 10 (CVSS v4.0). If your CloudPanel server runs PHP 8.2, 8.3, 8.4, or 8.5, update now — the fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

What Are These Vulnerabilities?

Both CVEs live in PHP’s core interpreter and can be exploited by an unauthenticated HTTP request — no login, no special account needed.

CVERoot causeExploitable via
CVE-2026-109618Out-of-memory corruption: when PHP runs out of memory mid-request, it leaves data half-initialized, which cleanup code then processes as valid — leading to RCEFile uploads, multipart form posts, any request that pushes PHP past its memory limit
CVE-2026-109619Stale global state: references to a completed request’s memory survive into the next request on the same PHP-FPM worker, enabling use-after-free exploitationAny follow-up request on the same worker, especially if session upload progress is enabled

Severity: CVSS v4.0 score of 9.2 for both. PHP’s own advisory describes updating as “the only safe choice” and flags Apache with mod_php as the highest-risk configuration.

Fixed versions:

  • PHP 8.2.35
  • PHP 8.3.36
  • PHP 8.4.27
  • PHP 8.5.12

Am I Affected?

SSH into your server and run:

php -v

You are vulnerable if the output shows any version lower than:

  • PHP 8.2.x → vulnerable below 8.2.35
  • PHP 8.3.x → vulnerable below 8.3.36
  • PHP 8.4.x → vulnerable below 8.4.27
  • PHP 8.5.x → vulnerable below 8.5.12
  • PHP 8.1 or older → no patch available (end of life — see section below)

CloudPanel typically runs PHP-FPM. To check every FPM version installed on the server:

find /usr/bin /usr/sbin -name 'php*' | sort

How to Fix in CloudPanel

Step 1 — Update the package list

SSH into your server as root or a sudo user, then run:

sudo apt update

If the patched PHP version does not appear in the next step, your server may be missing the Ondrej Surý PHP repository. Add it first:

sudo add-apt-repository ppa:ondrej/php
sudo apt update

Step 2 — Upgrade PHP

Run the upgrade command for every PHP version you have installed. CloudPanel allows multiple versions side by side, so run each that applies:

# PHP 8.2
sudo apt install --only-upgrade php8.2 php8.2-fpm php8.2-common

# PHP 8.3
sudo apt install --only-upgrade php8.3 php8.3-fpm php8.3-common

# PHP 8.4
sudo apt install --only-upgrade php8.4 php8.4-fpm php8.4-common

# PHP 8.5
sudo apt install --only-upgrade php8.5 php8.5-fpm php8.5-common

Alternatively, upgrade everything at once:

sudo apt upgrade -y

Step 3 — Restart PHP-FPM

The new binaries will not take effect until the FPM workers are restarted. Restart each version you upgraded:

sudo systemctl restart php8.2-fpm
sudo systemctl restart php8.3-fpm
sudo systemctl restart php8.4-fpm
sudo systemctl restart php8.5-fpm

Step 4 — Verify

Confirm the patched version is now active:

php -v

Expected output (example for PHP 8.3):

PHP 8.3.36 (cli) (built: Oct 21 2026 …)

You can also create a temporary file at a domain’s web root:

<?php phpinfo(); ?>

Open it in a browser, check the version at the top, then delete the file immediately — phpinfo() exposes sensitive server configuration.

Temporary Mitigations (If You Cannot Patch Immediately)

These do not make an unpatched server safe. They reduce specific attack paths only. Apply the patch as soon as possible.

Important for CloudPanel: CloudPanel passes PHP settings to each site via fastcgi_param PHP_VALUE. That means application-level ini_set() calls happen after request parsing and will not block these vulnerabilities. All mitigations below must be applied in php.ini or the PHP-FPM pool config, followed by a worker restart.

Against CVE-2026-109619 (stale global state)

Disable session upload progress. Edit /etc/php/8.x/fpm/php.ini (repeat for each version) and set:

session.upload_progress.enabled = 0

Then restart FPM:

sudo systemctl restart php8.x-fpm

Against CVE-2026-109618 (OOM corruption)

Reduce the attack surface by limiting how large a request PHP will accept:

post_max_size = 8M
upload_max_filesize = 8M

On Apache with mod_php only, you can also set:

memory_limit = -1

(This removes the memory cap so PHP never hits an OOM mid-request, which is the trigger. It is not recommended on PHP-FPM.)

Reduce worker state persistence (PHP-FPM)

Setting pm.max_requests = 1 forces each FPM worker to restart after a single request, preventing stale state from carrying over. This has a performance cost but closes the CVE-2026-109619 carry-over path:

pm.max_requests = 1

Restart FPM after any change.

What About PHP 8.1 and Older?

The PHP project has reached end-of-life for PHP 8.1 (December 2025) and all earlier versions. No patch will be released for these versions. Servers running PHP 8.1 or older remain vulnerable with no official fix available.

Your options:

  1. Upgrade to PHP 8.2 or newer — this is the only safe path. In CloudPanel, you can install a newer PHP version from Admin → PHP and then switch each domain under Domains → [your domain] → PHP Version.
  2. Isolate the server behind a WAF or firewall that blocks multipart/form-data and file upload requests if an immediate upgrade is not feasible — this is a stopgap only.
  3. Take the server offline until the upgrade is completed, if the risk is unacceptable.

Sansec and the PHP security team have both confirmed no backport is planned for 8.1 or earlier.

Sources

Related Posts