PHP vulnerability

Community Support
1

If I stop the Apache service until the patch is available, will my HestiaCP be safe until then?

2

yes, but also hestia service needs to be stopped

3

I’m not using Apache, just nginx: am I OK?

Thanks!

4

No, the security issue is with PHP, regardless of whether you use Nginx or Apache. You should upgrade your OS now, as new and fixed PHP versions are available. However, you should stop Hestia (systemctl stop hestia) until we can build the new hestia-php package, which is already in the works.

5

Thank-you @sahsanu !

6

Trying to fully understand the issue, even if i patch latest php update you are saying the panel is compromised until hestia build new hestia-php package? @Raphael @sahsanu

7

Yes, that’s correct. We are building hestia-php packages but it takes a few hours.

8

PHP2Shell: how to patch old PHP (7.x / 5.6) on HestiaCP without migrating

The sury.org repo (used by HestiaCP) has backported the fix to old PHP versions too, including 7.1 and 5.6.

1. Update all PHP versions:

bash

apt update
apt install --only-upgrade 'php*'

2. Restart PHP-FPM and Apache:

bash

for v in $(ls /etc/php/); do systemctl restart php$v-fpm 2>/dev/null; done
systemctl restart apache2

3. Check it worked (example for 7.1):

bash

zcat /usr/share/doc/php7.1-fpm/changelog.Debian.gz | grep CVE-2026-10961

If you see CVE-2026-109618, CVE-2026-109619, you’re patched.

For PHP 8.x, php8.2 -v should show 8.2.35 (8.3.36, 8.4.27, 8.5.12 for the other branches).

Tested on Debian 12 with PHP 7.1, 8.2 and 8.5. This buys time, but plan to migrate off old PHP anyway.

9

The repo is returning a 503 :frowning:

Err:1 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php-common all 2:101~+ubuntu24.04.1+deb.sury.org+1
  503  Service Unavailable [IP: 185.125.189.186 443]
Err:2 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php8.3-zip amd64 8.3.35-1+ubuntu24.04.1+deb.sury.org+1
  503  Service Unavailable [IP: 185.125.189.186 443]
Err:3 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php8.3-xml amd64 8.3.35-1+ubuntu24.04.1+deb.sury.org+1
  503  Service Unavailable [IP: 185.125.189.186 443]
Get:4 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php8.3-soap amd64 8.3.35-1+ubuntu24.04.1+deb.sury.org+1 [135 kB]
Err:7 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php8.3-opcache amd64 8.3.35-1+ubuntu24.04.1+deb.sury.org+1
  503  Service Unavailable [IP: 185.125.189.186 443]
Err:8 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php8.3-mysql amd64 8.3.35-1+ubuntu24.04.1+deb.sury.org+1
  503  Service Unavailable [IP: 185.125.189.186 443]
Err:9 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php8.3-ldap amd64 8.3.35-1+ubuntu24.04.1+deb.sury.org+1
  503  Service Unavailable [IP: 185.125.189.186 443]
Err:10 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php8.3-bz2 amd64 8.3.35-1+ubuntu24.04.1+deb.sury.org+1
  503  Service Unavailable [IP: 185.125.189.186 443]
Err:12 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php8.3 all 8.3.35-1+ubuntu24.04.1+deb.sury.org+1
  503  Service Unavailable [IP: 185.125.189.186 443]
10

migrate to Index of /php/, check the readme and delete the old sources.list file of the old sury repo.

check Heads Up! Upcoming Critical PHP Security Release - #4 by eris

11

I’ve been checking periodically for a PHP 8.5 update, but it keeps offering version 8.5.11, while the official PHP website lists 8.5.12 as available for download. Is this happening only to me, or is it a widespread issue?

12

Same for me on all my servers.
It looks like the entire planet is upgrading PHP versions

13

If you are using ARM, as far as I know, Ondrej didn’t finish to build the packages for that architecture yet.

14

Arm builds will take some time unfortunately as they will be build as the last (5h building time per one). You can watch progress/availability e.g. here PHP CVE-2026-109618 and CVE-2026-109619: how to apply the patches · ma.ttias.be

15

Thanks for sharing the link! The only thing is that the page doesn’t seem to take Ubuntu 26.04 into account (unless it’s included but not shown in the legend).

16

I am in the process of upgrading, removed port forwarded port for the panel to keep websites up

17

It’s included, already patched all my amd64 on 26.04, just arm64 still nothing.

For more details live discussion with Ondrej here #145 - Upcoming Critical PHP Security Release - oerdnj/deb.sury.org - Codeberg.org

18

I was talking about the page you shared.

19

I have updated all php versions but hestia-php 8.5.9-1+ubuntu24.04 is not being updated. I have hestia disabled on my server for now. will hestia-php get an update?

20

If I am currently using php 8.3 on my sites do I need to do anything or wait until hestiacp releases an update?