Important: Critical PHP Security Vulnerabilities

[Alexander]

Hello,

here’s a short summary of what’s coming our way today:

The PHP security team has announced an update for two critical security vulnerabilities for today, Wednesday, October 21, at 14:00 UTC (16:00 CEST). Since the update was announced in advance and both vulnerabilities are rated as highly critical, the situation is quite serious.

https://www.php.net/
https://sansec.io/research/php2shell

Overview:
There are currently two critical security vulnerabilities that allow remote code execution.
All PHP versions from 5.x to 8.5 are affected.
It is currently unknown whether older PHP versions (< 8.2) will receive updates at all. You should expect that these, if they come at all, will only be available with a delay.


Default PHP version of the operating system:
The default PHP version of the operating system is expected to be updated promptly by the operating system vendors as well.

With KeyHelp’s default settings, these updates are installed every two days between 3 and 4 a.m. If they are released during the course of today, they will be installed on Friday at the latest.
To install the updates immediately, go to “Maintenance intervals → Update server services” or run the command “keyhelp run package-update”.


Additional PHP interpreters:
The additional PHP interpreters available through KeyHelp will receive an update as quickly as I can manage. If PHP publishes the release at 14:00 UTC and the download servers withstand the rush from all over the world, you can expect the release around 16:00 UTC (18:00 CEST).

With KeyHelp’s default settings, these updates are installed in the early morning hours (05:00–07:00), so if they are released during the course of today, they will be installed tomorrow morning.
To install the updates immediately, go to “Maintenance intervals → Update PHP interpreters” or run the command “keyhelp run php-update”.


Patched PHP versions:
The following versions include the patch. As soon as these versions are running on your server, you are safe.
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
If older PHP versions are in use, the server remains vulnerable through them!


EOL operating systems:
Operating systems that have reached their end of life no longer receive updates, including PHP updates.
Older operating systems (Debian 11 and older, Ubuntu 20 and older) must be upgraded to a newer version in order to continue receiving PHP updates. (Guide: https://www.keyweb.de/en/support/learn- ... s-upgrades)

[BasHeijermans]

I already updated as the patch is released.

[jannisgo]

Hi, got some problem: I successfully installed the new PHP versions; but the System interpreter still is on 8.3.6.
How can I change it?

[Alexander]

This is expected behavior for the system default PHP version, as they are pinned to a certain version by the OS manufactures.
The OS-manufacture will supply security fixes. So looking at the patch level is more appropriate.

Please check

Code: Select all

apt-cache policy php8.3-cli

It should look like this and you will be fine.

Code: Select all

root@dev16:~# apt-cache policy php8.3-cli
php8.3-cli:
  Installiert:           8.3.6-0ubuntu0.24.04.13
  Installationskandidat: 8.3.6-0ubuntu0.24.04.13

[amarc]

If I understand: panel itself is using 'default' PHP from distro ? So apt update && apt upgrade ? Every other version update via PHP interpreters ? I am confused because even tho I updated today I still see panel is using 8.2.34.. Maybe this is just Debian numbering/version thing ?

[Chalipa]

Seems like it's patched now. PHP 8.4.27


I do have 7.4.33 as well, do i need to patch this myself manually? or it will be done automatically?

[Alexander]

I do have 7.4.33 as well, do i need to patch this myself manually? or it will be done automatically?

I was able to make the additional PHP interpreters 7.4 / 8.0 / 8.1 also work with the recent fix.
They are currently compiling and I will release them, within the next hours.
If not installed manually (command: "keyhelp run php-update"), they will be installed at least tomorrow morning.

If I understand: panel itself is using 'default' PHP from distro ? So apt update && apt upgrade ? Every other version update via PHP interpreters ? I am confused because even tho I updated today I still see panel is using 8.2.34.. Maybe this is just Debian numbering/version thing ?

Which OS and architecture do you use?

[Tony20]

Hello, I am using Debian 13.7 (64-bit)


My keyhelp Panel is showing

PHP 8.4.27 as Default PHP version of the operating system


php v
PHP 8.4.27 (cli) (built: Oct 21 2026 07:53:46) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.27, Copyright (c) Zend Technologies
with the ionCube PHP Loader v15.5.0, Copyright (c) 2002-2026, by ionCube Ltd.
with SourceGuardian v17.0.0, Copyright (c) 2000-2025, by SourceGuardian Ltd.
with Zend OPcache v8.4.27, Copyright (c), by Zend Technologies

Is there a way to upgrade this ?

[Tiresias]

Hello, I am using Debian 13.7 (64-bit)


My keyhelp Panel is showing

PHP 8.4.27 as Default PHP version of the operating system


php v
PHP 8.4.27 (cli) (built: Oct 21 2026 07:53:46) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.27, Copyright (c) Zend Technologies
with the ionCube PHP Loader v15.5.0, Copyright (c) 2002-2026, by ionCube Ltd.
with SourceGuardian v17.0.0, Copyright (c) 2000-2025, by SourceGuardian Ltd.
with Zend OPcache v8.4.27, Copyright (c), by Zend Technologies

Is there a way to upgrade this ?

Hi!

The build date shown in your output (October 21, 2026) is already a good indication that you are running an updated Debian PHP package.
However, `php -v` does not display the Debian package revision, which is what matters when checking for security updates.
You can check the installed versions via terminal with:

Code: Select all

dpkg-query -W php8.4-cli php8.4-common php8.4-fpm

The latest Debian 13 security update is 8.4.27-1~deb13u1.

If your installed packages show this version, you have the current Debian security update installed, even though KeyHelp and `php -v` only display PHP 8.4.27.

You can also inspect the Debian changelog:

Code: Select all

zless /usr/share/doc/php8.4-cli/changelog.Debian.gz

With Debian 13, it should show something like:

Code: Select all

php8.4 (8.4.27-1~deb13u1) trixie-security; urgency=high

  * New upstream version 8.4.27
    + (CVE-2026-109618, CVE-2026-109619): Avoid state corruption via
      bailout.

Debian frequently backports security fixes without changing the upstream PHP version number. Therefore, PHP 8.4.27 in the KeyHelp panel does not mean that the security patches are missing.

[Tony20]

Hello, I am using Debian 13.7 (64-bit)


My keyhelp Panel is showing

PHP 8.4.27 as Default PHP version of the operating system


php v
PHP 8.4.27 (cli) (built: Oct 21 2026 07:53:46) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.27, Copyright (c) Zend Technologies
with the ionCube PHP Loader v15.5.0, Copyright (c) 2002-2026, by ionCube Ltd.
with SourceGuardian v17.0.0, Copyright (c) 2000-2025, by SourceGuardian Ltd.
with Zend OPcache v8.4.27, Copyright (c), by Zend Technologies

Is there a way to upgrade this ?

Hi!

The build date shown in your output (October 21, 2026) is already a good indication that you are running an updated Debian PHP package.
However, `php -v` does not display the Debian package revision, which is what matters when checking for security updates.
You can check the installed versions via terminal with:

Code: Select all

dpkg-query -W php8.4-cli php8.4-common php8.4-fpm

The latest Debian 13 security update is 8.4.27-1~deb13u1.

If your installed packages show this version, you have the current Debian security update installed, even though KeyHelp and `php -v` only display PHP 8.4.27.

You can also inspect the Debian changelog:

Code: Select all

zless /usr/share/doc/php8.4-cli/changelog.Debian.gz

With Debian 13, it should show something like:

Code: Select all

php8.4 (8.4.27-1~deb13u1) trixie-security; urgency=high

  * New upstream version 8.4.27
    + (CVE-2026-109618, CVE-2026-109619): Avoid state corruption via
      bailout.

Debian frequently backports security fixes without changing the upstream PHP version number. Therefore, PHP 8.4.27 in the KeyHelp panel does not mean that the security patches are missing.

Thank you!

[Chalipa]

Seems like it's back

https://thehackernews.com/2026/10/urgen ... d.html?m=1