PHP released fixes today for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
1. Upgrade to the fixed PHP packages
To upgrade the installed PHP packages, and restart PHP-FPM SSH into the server as root user and run the following commands:
apt-get update
apt-get install --only-upgrade 'php8.*'
systemctl restart 'php*-fpm'
2. Turn off upload progress
File uploads still work. PHP’s built-in upload progress meter may stop updating.
sed -i -E 's/^;?session\.upload_progress\.enabled.*/session.upload_progress.enabled = Off/' /etc/php/*/fpm/php.ini
grep -H 'session.upload_progress.enabled' /etc/php/*/fpm/php.ini
If the server is running old versions like PHP 7, install PHP 8.2 or newer from Services. The supported versions are 8.2, 8.3, 8.4, and 8.5. Then switch the site to that version in its PHP Settings.
A new PHP installation from the Services page already receives the fixed package.