There’s been quite a lot happening around PHP security recently so we wanted to bring everything together in one place and make sure everyone knows what happened, how we’ve responded, and what it means for their PanelAlpha installations.
On October 21, the PHP team released emergency fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively known as PHP2Shell. Both could potentially allow attackers to execute code on affected servers without authentication. Official fixes were released for PHP 8.2 through 8.5, along with source patches for older PHP versions.
Then, on October 23, PHP disclosed another RCE risk (CVE-2026-115560) affecting a specific combination of session settings and application behavior. The PHP team recommended disabling session.upload_progress.enabled until a permanent fix becomes available.
How we protect PanelAlpha users
We released the first PanelAlpha security updates on October 21, followed by another round of Engine fixes on October 22. Our latest releases include fixes for both critical PHP2Shell vulnerabilities as well as the recommended safeguard for CVE-2026-115560. We’ve also included backported fixes for PHP 7.4, 8.0 and 8.1 in our Engine images, updated PHP components such as phpMyAdmin and patched the Node.js runtime used by Lighthouse.
What you need to do now
Make sure you’re running the latest versions:
- Control Panel / Multi Server: 1.9.8.4
- Engine v1: 1.0.23.2
- Engine v2: 2.1.2.2
With these updates installed and default PHP settings unchanged, no additional configuration changes are needed for CVE-2026-115560. We still strongly recommend moving websites away from unsupported PHP versions and checking any PHP installations you manage outside PanelAlpha. Remember that updating Engine doesn’t automatically change the PHP version selected for your existing sites.
The whole process, including the fixes and our recommendations, is covered by the following two articles:
We’ll continue keeping a close eye on PHP security developments and releasing further updates whenever needed. If you’re unsure about your setup or have any questions about the updates, feel free to ask below or join us on Discord. We’re happy to help!