apparently big php security patch coming out tomorrow:
hopefully hestiacp will get a quick update.
I see that the @eris has recommended to update PHP in this pinned post, so I’m assuming that we’ll have to do that manually.
We only able to push an auto update hestia and hestia-* packages If php8.5.12 becomes available we are able to download it and build Hestia-php packages
So the rest need to be done manually
Thanks for the reply. Besides updating PHP what is “the rest”…?
For now:
Disable session.upload_progress.enabled in php.ini
Block all multipart requests (file upload via HTTP) temp
PHP 8.5.12 is out. Is upgrading from Debian will fix it or should I wait for Hestia packages?
Is the update out https://www.php.net/archive/2026.php#2026-10-21-5
Update now.. Hestia-php needs to build tonight
is it safe to update now?
Thank you eris for the quick reply!
Do versions 7.0 and 7.1 represent any alternative?
you can update now.
where to grab the update?
root@hcp:~# apt list --upgradeable
Listing… Done
ca-certificates/noble-updates,noble-security 20260816ubuntu0.24.04.1 all [upgradable from: 20260601~24.04.1]
cloud-init/noble-updates 26.2-0ubuntu1~24.04.1 all [upgradable from: 26.1-0ubuntu1~24.04.1]
containerd.io/noble 2.4.2-3~ubuntu.24.04~noble amd64 [upgradable from: 2.4.2-2~ubuntu.24.04~noble]
distro-info-data/noble-updates 2026.10.12-0ubuntu0.24.04.1 all [upgradable from: 0.72-0ubuntu0.24.04.1]
docker-buildx-plugin/noble 0.38.1-1~ubuntu.24.04~noble amd64 [upgradable from: 0.38.0-1~ubuntu.24.04~noble]
docker-ce-cli/noble 5:29.9.2-1~ubuntu.24.04~noble amd64 [upgradable from: 5:29.9.1-1~ubuntu.24.04~noble]
docker-ce-rootless-extras/noble 5:29.9.2-1~ubuntu.24.04~noble amd64 [upgradable from: 5:29.9.1-1~ubuntu.24.04~noble]
docker-ce/noble 5:29.9.2-1~ubuntu.24.04~noble amd64 [upgradable from: 5:29.9.1-1~ubuntu.24.04~noble]
docker-compose-plugin/noble 5.6.1-1~ubuntu.24.04~noble amd64 [upgradable from: 5.6.0-1~ubuntu.24.04~noble]
gir1.2-glib-2.0/noble-updates 2.80.0-6ubuntu3.10 amd64 [upgradable from: 2.80.0-6ubuntu3.9]
libglib2.0-0t64/noble-updates 2.80.0-6ubuntu3.10 amd64 [upgradable from: 2.80.0-6ubuntu3.9]
libglib2.0-bin/noble-updates 2.80.0-6ubuntu3.10 amd64 [upgradable from: 2.80.0-6ubuntu3.9]
libglib2.0-data/noble-updates 2.80.0-6ubuntu3.10 all [upgradable from: 2.80.0-6ubuntu3.9]
liblzma5/noble-updates,noble-security 5.6.1+really5.4.5-1ubuntu0.4 amd64 [upgradable from: 5.6.1+really5.4.5-1ubuntu0.3]
libunbound8/noble-security 1.19.2-1ubuntu3.12 amd64 [upgradable from: 1.19.2-1ubuntu3.10]
python3-jwt/noble-updates,noble-security 2.7.0-1ubuntu0.4 all [upgradable from: 2.7.0-1ubuntu0.3]
tmux/noble-updates 3.4-1ubuntu0.2 amd64 [upgradable from: 3.4-1ubuntu0.1]
ubuntu-pro-client-l10n/noble-updates 38ubuntu0~24.04 amd64 [upgradable from: 37.2ubuntu~24.04.1]
ubuntu-pro-client/noble-updates 38ubuntu0~24.04 amd64 [upgradable from: 37.2ubuntu~24.04.1]
xz-utils/noble-updates,noble-security 5.6.1+really5.4.5-1ubuntu0.4 amd64 [upgradable from: 5.6.1+really5.4.5-1ubuntu0.3]
root@hcp:~#
Looks like both ubuntu and debian dont have the updated php version available.
Hestia uses ondrej repos for php and apache repos but their servers appear overloaded
W: Failed to fetch ``https://ppa.launchpadcontent.net/ondrej/apache2/ubuntu/dists/noble/InRelease`` 503 Service Unavailable [IP: 185.125.189.188 443]
W: Failed to fetch ``https://ppa.launchpadcontent.net/ondrej/php/ubuntu/dists/noble/InRelease`` 503 Service Unavailable [IP: 185.125.189.188 443]
As per their official Launchpad page, you can use their new repo at https://packages.sury.org/
One-liner to add it:
curl -fsSL https://packages.sury.org/php/README.txt | bash
#!/usr/bin/env bash
set -euo pipefail
apt-get update
apt-get install -y lsb-release ca-certificates curl gnupg
codename="$(lsb_release -sc)"
arch="$(dpkg --print-architecture)"
# Remove any old ondrej/sury source files
grep -rl ondrej /etc/apt/sources.list.d 2>/dev/null | xargs -r rm -f
# Fetch the signing key first
curl -fsSL https://packages.sury.org/php/apt.gpg | gpg --dearmor -o /usr/share/keyrings/sury-keyring.gpg
# Add the repository
echo "deb [arch=${arch} signed-by=/usr/share/keyrings/sury-keyring.gpg] https://packages.sury.org/php/ ${codename} main" \
> /etc/apt/sources.list.d/php.list
apt-get update
For hestia we are building the packages but will take some time easiest method is to temproy disable hestia or
In /usr/local/hestia/php/lib/php.ini
memory_limit=-1
post_max_size = 8M
session.upload_progress.enabled=0
I can confirm that i was able to update in Debian 11, using Sury repos.
from 7.4 to 8.3
Once you’ve updated PHP, disable Hestia while waiting for Hestia upgrade with:
systemctl stop hestia
It won’t break your services, it just disables the panel. If you need it back again, you can just systemctl start hestia.
Will the update fix 8.1 and older? Or do we need to do this? I’m going through my servers now and running your update script , and removing any old PHP versions we don’t need. But annoyingly we still have some people using older PHP versions - so I can’t get rid of 8.1 or even 5.6 on one site!