On October 21, the PHP team released fixes for two critical flaws (CVE-2026-109618 and CVE-2026-109619) that could allow attackers to run code without logging in. Node.js received patches too, addressing code execution and bypasses of HTTPS certificate checks.
Yesterday, we released PanelAlpha Control Panel and Engine updates with the PHP fixes available at the time. More patches followed, and today’s Engine updates cover them too. Both Engine v1.0.23.2 and v2.1.2.2 include updated PHP in phpMyAdmin and Node.js in Lighthouse. Engine 1.x also has patched PHP for LiteSpeed sites and the extra session protection already introduced in Engine 2.x yesterday. We’ve prepared patched LiteSpeed images for Engine 2.x as well, ready for when support returns.
With both releases now out, we’ve completed this round of PHP and Node.js security updates. All relevant fixes are now in place across Engine’s supported components. Sites running older PHP versions still need separate attention.
If you read yesterday’s security update, this is the next step: what else we have patched, and what you still need to check on your servers.
What we have updated in Engine
The updates cover slightly different components in each Engine generation, but the priority remains the same: making sure the services included with Engine use patched PHP and Node.js builds.
PanelAlpha Engine 1.x → update to v1.0.23.2
We have updated PHP 8.2, 8.3 and 8.4 for customer sites running on LiteSpeed. The PHP version inside phpMyAdmin has also been updated, along with the Node.js runtime used by Lighthouse for website performance checks.
We have also added another layer of protection to PHP session handling on customer accounts. This helps reduce exposure on older PHP versions, but it cannot replace the security fixes those unsupported versions will not receive.
PanelAlpha Engine 2.x (open source) → update to v2.1.2.2
Engine 2.x now includes updated PHP in phpMyAdmin and Node.js in Lighthouse. We’ve also prepared patched PHP 8.2, 8.3 and 8.4 images for LiteSpeed, ready for when LiteSpeed support returns to Engine 2.x. For now, websites on Engine 2.x run through nginx. On new installations, Engine also downloads a ready-made web server image instead of building it directly on the server.
For Node.js applications built directly by Engine, the updated runtime will be picked up on the next deployment. If your project uses its own Dockerfile or docker-compose configuration, you’ll need to update the Node.js image yourself and redeploy the application. Engine won’t do that automatically.
PHP 7.4, 8.0 and 8.1 still need your attention
These versions are no longer supported by the PHP team and will not receive fixes for the two critical CVEs. If your WordPress sites or other PHP projects still use them, please move to PHP 8.2 or newer with the security patches applied. The additional session protection, now available in both Engine 1.x and 2.x, helps reduce the risk but cannot replace the missing PHP security fixes. Updating Engine alone will not automatically change the PHP version in every existing site.
What you should do now
- Update your Engine installation. Even if you applied yesterday’s fixes, update Engine to either v1.0.23.2 or v2.1.2.2 depending on your setup. You’ll find the instructions in our Engine 1.x update guide or Engine 2.x update guide.
Using Control Panel with Engine? Stick with your current Engine generation for now and update it to v1.0.23.2. We’re already working on the dedicated Control Panel update that will let you move to Engine 2.x once it’s ready.
- Check the PHP version of each site. Move sites on PHP 7.4, 8.0 or 8.1 to a patched, supported version. Remember to check the PHP used by WordPress sites and scheduled tasks, not only the Engine version.
- Check your Node.js applications on Engine 2.x. If you’re still using Node.js 18 or 20, move to a patched version of Node.js 22 or 24 first. Applications built by Engine will pick up the updated runtime when redeployed. For projects using a custom Dockerfile or docker-compose configuration, update the Node.js image manually, then rebuild and redeploy.
- Make sure everything is working. Check a few hosted sites, phpMyAdmin and performance tests, then review the logs for anything unusual.
What about Client and Admin Areas?
The Node.js vulnerabilities announced on October 21 do not affect the PanelAlpha Client Area or Admin Area, because neither uses Node.js at runtime. These additional Node.js updates concern the Engine components mentioned above and Node.js applications deployed by users.
Keeping your Engine protected
Over the past two days, we have worked through the places where Engine uses PHP and Node.js, including the ones you do not normally see when managing a website. With this follow-up, the Engine builds we maintain now include all relevant fixes for the vulnerabilities disclosed on October 21.
But don’t let your guard down just yet. There are still two things to check on your end: sites running unsupported PHP versions need an upgrade, and Node.js applications on Engine 2.x need a supported, patched runtime. If you’re still using Node.js 18 or 20, move to a patched version of 22 or 24 before redeploying. Projects with a custom Dockerfile or docker-compose configuration also need a manual Node.js image update.
If you updated Engine yesterday, please make sure to install today’s release too.
Further reading
- Yesterday’s PanelAlpha security update
- Official PHP security release
- Node.js October 21 security release
Not sure what this means to your installation?
If you have questions about the updates, your PHP versions or any of the steps above, come talk to us on Discord. We are happy to help you check what needs attention.
Join us on Discord →
Comments