Security Advisory: Critical PHP Vulnerabilities

woody

Updated 22 October 2026: PHP 8.2.35 is now available. The steps below are current.

CVE-2026-109618 and CVE-2026-109619 · CVSS v4.0 9.2 (Critical)

Action required: the fix is now released. Update PHP 8.2 to 8.2.35 on every MultiPortal server. No MultiPortal update is needed.

What’s happening

The PHP security team has released fixes for two critical vulnerabilities in PHP itself. They are not in MultiPortal’s code, but every MultiPortal installation runs on PHP, so all servers are affected until PHP is updated.

For PHP 8.2, which MultiPortal uses, the fix is PHP 8.2.35.

Availability


PHP release	PHP 8.2.35, released 21 October 2026 (release notes)
Ubuntu (ondrej/php)	Available for 22.04 and 24.04
Debian (packages.sury.org)	Available

Will MultiPortal be affected by the update?

We do not expect the update to cause any issues. MultiPortal and its required packages, including the ionCube loader, are designed to work with any PHP 8.2.x release.

We are testing the update now and will advise here once we have performed the updates, including if anything further is required.

How to update

Update PHP 8.2 to 8.2.35 or later.

Ubuntu (ondrej/php repository)

1. Check the fix has reached your repository

sudo apt update
apt-cache policy php8.2-fpm

The Candidate line must start with 8.2.35, for example 8.2.35-1+ubuntu22.04.1+deb.sury.org+1. If it still shows an older version, run sudo apt update again.

2. Upgrade PHP

sudo apt install --only-upgrade 'php8.2*'

3. Restart PHP and the MultiPortal workers

sudo systemctl restart php8.2-fpm 'multiportal-queue@*'

4. Confirm

php8.2 -v

Debian (packages.sury.org repository)

Debian servers often don’t have sudo installed. If yours doesn’t, run these as root (su -) and leave sudo off each command.

1. Check the fix has reached your repository

sudo apt update
apt-cache policy php8.2-fpm

The Candidate line must start with 8.2.35 and come from packages.sury.org, for example 8.2.35-1+0~20261021.94+debian12~1.gbp8bff78 on Debian 12. If it still shows an older version, run sudo apt update again.

2. Upgrade PHP

sudo apt install --only-upgrade 'php8.2*'

3. Restart PHP and the MultiPortal workers

sudo systemctl restart php8.2-fpm 'multiportal-queue@*'

4. Confirm

php8.2 -v

On both Ubuntu and Debian, you should see PHP 8.2.35 and the line “with the ionCube PHP Loader”.

If the repository is unavailable

If your server cannot download the update from the repository, we have packaged the official PHP 8.2.35 files for Ubuntu 22.04, Ubuntu 24.04, Debian 12 and Debian 13:

php8.2.35-debs.zip

SHA-256: 20c256092cf6d0314e86abe3ed7ad40b0adbfa78ba5fcbf0f8e7963dab22d45e

These are the official packages from the ondrej/php PPA and packages.sury.org, unchanged. Each folder includes a SHA256SUMS file matching the repository’s signed package index.

wget https://downloads.multiportal.io/packages/php/php8.2.35-debs.zip
sha256sum php8.2.35-debs.zip
unzip php8.2.35-debs.zip
cd php8.2.35-debs/*-$(lsb_release -cs)
sha256sum -c SHA256SUMS
sudo apt install ./*.deb
sudo systemctl restart php8.2-fpm 'multiportal-queue@*'
php8.2 -v

The cd line picks the folder for your server’s release automatically: ubuntu-22.04-jammy, ubuntu-24.04-noble, debian-12-bookworm or debian-13-trixie. Every line of sha256sum -c must say OK.

If apt install reports unmet dependencies such as libc6 (>= 2.38) or libssl3t64, those packages are for a different release than your server. Nothing has been installed. Check lsb_release -cs and use the matching folder.

What you don’t need to do

No MultiPortal update is required
No ionCube changes and no re-encoding are needed
New installations pick up PHP 8.2.35 automatically

We’ll update this post with our test results once we have completed our own updates. If you run into any trouble, reply here or raise a support ticket.

Matt

woody

Update: PHP 8.2.35 is now available

PHP 8.2.35, which fixes CVE-2026-109618 and CVE-2026-109619, is now published for Ubuntu 22.04 and 24.04 (ondrej/php) and Debian 12 and 13 (packages.sury.org).

The post above has been updated with the confirmed version and steps. It also covers:

what to do if apt reports “Mirror sync in progress?” or 503 Service Unavailable while the repositories are under load
a download of the official PHP 8.2.35 packages, if your server can’t reach the repository

Once updated, php8.2 -v should show PHP 8.2.35 and “with the ionCube PHP Loader”.

Matt

woody

For further references on the vulnerabilities

Vendor (PHP)

Security advisory:
https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619:
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Government advisories

CERT-EU Security Advisory 2026-018:
https://cert.europa.eu/publications/security-advisories/2026-018/

NCSC-NL operational repository:
https://github.com/NCSC-NL/php2shell