Security Advisory: Critical PHP Vulnerabilities
Updated 22 October 2026: PHP 8.2.35 is now available. The steps below are current.
CVE-2026-109618 and CVE-2026-109619 · CVSS v4.0 9.2 (Critical)
Action required: the fix is now released. Update PHP 8.2 to 8.2.35 on every MultiPortal server. No MultiPortal update is needed.
What’s happening
The PHP security team has released fixes for two critical vulnerabilities in PHP itself. They are not in MultiPortal’s code, but every MultiPortal installation runs on PHP, so all servers are affected until PHP is updated.
For PHP 8.2, which MultiPortal uses, the fix is PHP 8.2.35.
Availability
| PHP release | PHP 8.2.35, released 21 October 2026 (release notes) |
| Ubuntu (ondrej/php) | Available for 22.04 and 24.04 |
| Debian (packages.sury.org) | Available |
Will MultiPortal be affected by the update?
We do not expect the update to cause any issues. MultiPortal and its required packages, including the ionCube loader, are designed to work with any PHP 8.2.x release.
We are testing the update now and will advise here once we have performed the updates, including if anything further is required.
How to update
Update PHP 8.2 to 8.2.35 or later.
Ubuntu (ondrej/php repository)
1. Check the fix has reached your repository
sudo apt update
apt-cache policy php8.2-fpm
The Candidate line must start with 8.2.35, for example 8.2.35-1+ubuntu22.04.1+deb.sury.org+1. If it still shows an older version, run sudo apt update again.
2. Upgrade PHP
sudo apt install --only-upgrade 'php8.2*'
3. Restart PHP and the MultiPortal workers
sudo systemctl restart php8.2-fpm 'multiportal-queue@*'
4. Confirm
php8.2 -v
Debian (packages.sury.org repository)
Debian servers often don’t have sudo installed. If yours doesn’t, run these as root (su -) and leave sudo off each command.
1. Check the fix has reached your repository
sudo apt update
apt-cache policy php8.2-fpm
The Candidate line must start with 8.2.35 and come from packages.sury.org, for example 8.2.35-1+0~20261021.94+debian12~1.gbp8bff78 on Debian 12. If it still shows an older version, run sudo apt update again.
2. Upgrade PHP
sudo apt install --only-upgrade 'php8.2*'
3. Restart PHP and the MultiPortal workers
sudo systemctl restart php8.2-fpm 'multiportal-queue@*'
4. Confirm
php8.2 -v
On both Ubuntu and Debian, you should see PHP 8.2.35 and the line “with the ionCube PHP Loader”.
If the repository is unavailable
If your server cannot download the update from the repository, we have packaged the official PHP 8.2.35 files for Ubuntu 22.04, Ubuntu 24.04, Debian 12 and Debian 13:
SHA-256: 20c256092cf6d0314e86abe3ed7ad40b0adbfa78ba5fcbf0f8e7963dab22d45e
These are the official packages from the ondrej/php PPA and packages.sury.org, unchanged. Each folder includes a SHA256SUMS file matching the repository’s signed package index.
wget https://downloads.multiportal.io/packages/php/php8.2.35-debs.zip
sha256sum php8.2.35-debs.zip
unzip php8.2.35-debs.zip
cd php8.2.35-debs/*-$(lsb_release -cs)
sha256sum -c SHA256SUMS
sudo apt install ./*.deb
sudo systemctl restart php8.2-fpm 'multiportal-queue@*'
php8.2 -v
The cd line picks the folder for your server’s release automatically: ubuntu-22.04-jammy, ubuntu-24.04-noble, debian-12-bookworm or debian-13-trixie. Every line of sha256sum -c must say OK.
If apt install reports unmet dependencies such as libc6 (>= 2.38) or libssl3t64, those packages are for a different release than your server. Nothing has been installed. Check lsb_release -cs and use the matching folder.
What you don’t need to do
- No MultiPortal update is required
- No ionCube changes and no re-encoding are needed
- New installations pick up PHP 8.2.35 automatically
We’ll update this post with our test results once we have completed our own updates. If you run into any trouble, reply here or raise a support ticket.
Matt