Upgrade PHP on your servers (CVE-2026-109618, CVE-2026-109619)

#1

PHP released fixes today for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

1. Upgrade to the fixed PHP packages

To upgrade the installed PHP packages, and restart PHP-FPM SSH into the server as root user and run the following commands:

apt-get update
apt-get install --only-upgrade 'php8.*'
systemctl restart 'php*-fpm'

2. Turn off upload progress

File uploads still work. PHP’s built-in upload progress meter may stop updating.

sed -i -E 's/^;?session\.upload_progress\.enabled.*/session.upload_progress.enabled = Off/' /etc/php/*/fpm/php.ini

grep -H 'session.upload_progress.enabled' /etc/php/*/fpm/php.ini

If the server is running old versions like PHP 7, install PHP 8.2 or newer from Services. The supported versions are 8.2, 8.3, 8.4, and 8.5. Then switch the site to that version in its PHP Settings.

A new PHP installation from the Services page already receives the fixed package.

2 Likes
#2

If you upgraded a server from Ubuntu 20.04 to Ubuntu 22.04 and Cleavr can no longer connect to it, follow these steps to replace that server’s connection key with an ed25519 key.

If the server is inactive:

  1. Open servers list page.
  2. Click on the server status.
  3. Click on the Update Connection Settings.
  4. Expand Update Connection Key.

If the server is active:

Navigate to the server detail page, go to The Danger Zone, and open Connection Key.

On the Server:

  1. Copy the command Cleavr shows.
  2. SSH into the server as root with your own key.
  3. Run the command. It adds the new public key.

Back in Cleavr

  1. Click on Verify Key and Update.
  2. Cleavr shows Server connection key updated and checks the connection again.
  3. When the check succeeds, the server status should return to active.
#3

You can now upgrade PHP to the latest release directly in Cleavr.

  1. Navigate to the Services page.
  2. For each installed PHP version, open the three-dot menu.
  3. Click Upgrade PHP {x.y}, where {x.y} is the version number.
  4. Click Upgrade.

Cleavr's Upgrade PHP UI to upgrade installed PHP version to the latest one to address CVE vulnerability
Cleavr's Upgrade PHP UI to upgrade installed PHP version to the latest one to address CVE vulnerability1920×1339 101 KB

PHP 8.4 stays on 8.4 and moves to the latest 8.4 release. The same applies to 8.2, 8.3, and 8.5. Sites using that PHP version can return a brief 502 while PHP-FPM restarts.

PHP 8.1 and older, and PHP 7, do not get the supported fix. Install PHP 8.2 or newer from Services, then switch the site in its PHP Settings.

#4

Is there a way to have this functionality also for Node? Where you can update your node version to the newest minor upgrade? Seeing as node also was recently compromised. You can now only up- or downgrade to a major version.

1 Like
#5

Hello @happykemper,

Thank you for the suggestion. :pray:

We are already planning to allow users to upgrade to minor releases of any services installed using Cleavr, including NodeJS.

We will keep you updated on any progress.

#6

You can now upgrade NodeJS to the latest release directly from Cleavr.

  1. Navigate to the Services page.
  2. For NodeJS service, click on the three-dot menu.
  3. Click Upgrade NodeJS {xx.x}.
  4. Click Upgrade .
#7

That’s so helpful! Thank you for the fast implementation.

1 Like