Remediation of critical PHP vulnerabilities

As part of addressing the recent PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, the following PHP versions—ranging from 5.4 to 8.5—have been released in ispmanager:

• 5.4.45-1794
• 5.5.38-1794
• 5.6.40-1786
• 7.0.33-1786
• 7.1.33-1786
• 7.2.34-1786
• 7.3.33-1786
• 7.4.33-1782
• 8.0.30-1782
• 8.1.34-1782
• 8.2.35-1781
• 8.3.36-1781
• 8.4.27-1781
• 8.5.12-1781

Installation of updates

Via the ispmanager panel

To install updated versions of PHP via the control panel, follow the steps below:

1. Go to the Software configuration section
2. Select Update
3. Select Update list of available software and then Update software.
4. Click Update
5. Once the update is complete, go to the Services section.

6. Select the following services:

   Debian-based systemsRHEL-based systems

   • apache2
   • All apache2-isp@
   • All php-fpm
   • All phpNN-fpm, where NN is a PHP version

   • httpd
   • All httpd-isp@
   • All php-fpm
   • All phpNN-fpm, where NN is a PHP version
7. Restart the services by clicking Restart service in the menu above the list.

The actual PHP versions and the versions displayed in the control panel may differ immediately after an update; to resolve this discrepancy, reboot the server or restart the control panel:

/usr/local/mgr5/sbin/mgrctl -m ispmgr -R

Manually via the package manager

You can update PHP manually using the system package manager:

apt update
apt install --only-upgrade $(dpkg-query -W -f='${Package}\n' 'isp-php*' php 2>/dev/null)

systemctl restart apache2 'apache2-isp@*' 
systemctl restart 'php*fpm*'

dnf clean metadata
dnf update 'isp-php*' php

systemctl restart httpd 'httpd-isp@*'
systemctl restart 'php*fpm*'

The actual PHP versions and the versions displayed in the panel may differ immediately after an update; to resolve this discrepancy, reboot the server or restart the panel:

/usr/local/mgr5/sbin/mgrctl -m ispmgr -R

If it is not possible to update PHP

If it is not possible to update PHP, we recommend restricting access to your websites—for instance, by moving them behind a VPN or a Web Application Firewall (WAF)—until the vulnerability can be resolved.

In ispmanager, enable the WAF for your web server, select the OWASP rule set, and ensure that the following rules are active:

• Rules 920170 and 920180: Restrict malformed multipart requests, request delimiter mismatches, and data truncation—techniques often used to deceive the PHP handler;
• Rules 920370 and 920380: Limit the size of request headers and parameters to prevent the submission of large volumes of data intended to trigger an Out-of-Memory (OOM) condition;
• Rules 932100–932200: Inspect requests for embedded operating system commands to prevent the exploitation of memory-based vulnerabilities;
• Rules 933100–933190: Analyze incoming requests for malicious code to prevent injection attacks.

As a temporary measure, the PHP developers recommend the following actions for global PHP configuration settings:

• Set the memory_limit parameter to -1 :

  memory_limit=-1
  

• Use low values ​​for the post_max_size parameter:
  • Up to 8 MB if the project does not require file uploads;
  • Up to 32 MB if file uploads are required;
• The upload_max_filesize parameter must always be set to a value lower than post_max_size;

• Set the session.upload_progress.enabled parameter to 0:

  session.upload_progress.enabled=0
  

• For PHP 8.5, set the fatal_error_backtraces parameter to 0:

  fatal_error_backtraces=0
  

  After applying the changes, make sure to fully restart each worker or the entire web server;

• Use containers and cgroups to impose limits on web server workers, including the application of RLIMIT_AS and RLIMIT_DATA constraints.
• Remove any incorrect and/or obsolete request settings that might trigger diagnostic messages before the request is fully initialized.