On October 21, 2026, the PHP and Ubuntu teams released fixes for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, an attacker could remotely execute code on a server through a website running a vulnerable PHP version. Install the updates as soon as possible, and check both the system PHP version and the versions assigned to websites in FASTPANEL.

Step-by-step guide to updating PHP on Ubuntu and FASTPANEL

On October 21, 2026, fixes were released for two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they could allow an attacker to remotely execute code on a server through a PHP application. Install the updates and check which PHP version each website uses.

This guide is for Ubuntu 22.04 and Ubuntu 24.04. It covers the system PHP packages from Ubuntu repositories. If your website uses a separate PHP version installed through FASTPANEL, see “If your website uses PHP from FASTPANEL”.

1. Connect to the server

You will need the server’s IP address and either its password or an SSH key. On Windows, open PowerShell: click Start, type “PowerShell,” and launch the app. On macOS, open Terminal.

Enter this command, replacing SERVER-IP-ADDRESS with your server’s IP address:

ssh root@SERVER-IP-ADDRESS

For example:

ssh root@203.0.113.10

The first time you connect, you may be asked whether you trust the server. Type yes and press Enter. Then enter the server password and press Enter again. The password will not appear as you type—this is normal.

If you connect as a user other than root, add sudo before the commands below.

2. Check your Ubuntu version

Run this command:

lsb_release -a

Look for the Codename line in the output:

  • jammy — Ubuntu 22.04;
  • noble — Ubuntu 24.04.

3. Install PHP updates

First, refresh the list of available packages:

apt update

Then run the command for your Ubuntu version.

Ubuntu 22.04

apt install --only-upgrade '?name(^php[0-9.]+$)'

The system PHP version on Ubuntu 22.04 is PHP 8.1. The fixed package version is 8.1.2-1ubuntu2.28 or later.

Ubuntu 24.04

apt install --only-upgrade '?name(^php[0-9.]+$)'

The system PHP version on Ubuntu 24.04 is PHP 8.3. The fixed package version is 8.3.6-0ubuntu0.24.04.13 or later.

If you are prompted to confirm the installation, type Y and press Enter. The main PHP version number may stay the same: Ubuntu includes fixes in packages with its own build numbers.

4. Restart the server

After the update, reboot the server so running applications start using the updated packages:

reboot

Your SSH connection will be disconnected. Wait a couple of minutes, then reconnect to the server.

5. Check the installed package version

On Ubuntu 22.04, run:

dpkg-query -W php8.1-cli
apt-cache policy php8.1-cli

Check the Installed line. It should show version 8.1.2-1ubuntu2.28 or later.

On Ubuntu 24.04, run:

dpkg-query -W php8.3-cli
apt-cache policy php8.3-cli

The Installed line should show version 8.3.6-0ubuntu0.24.04.13 or later.

If your website uses PHP from FASTPANEL

FASTPANEL lets you assign a separate PHP version to each website. Therefore, updating system PHP with apt does not automatically update the panel’s additional PHP versions, such as those installed in /opt/php74 or /opt/php81.

  1. Open FASTPANEL and go to the website’s settings page.
  2. Open the website’s PHP settings and check which version is selected.
  3. In the panel, go to “Settings” → “Applications” and check whether an update is available for that PHP version.
  4. If no update is available, contact FASTPANEL support to ask whether a fixed build is available.

Do not switch a live website to another PHP version without first checking that the website and its extensions are compatible. After installing or changing the version, open the website and make sure it works correctly.

Important: consider a website updated only after checking the PHP version assigned to that specific website. Checking the system command php -v alone does not confirm this.

Sources: Ubuntu’s guidance on the PHP vulnerabilities and FASTPANEL documentation on PHP versions.