Two serious vulnerabilities in PHP, each rated 9.2 out of 10 under CVSS v4.0, have prompted urgent security updates across the PHP ecosystem. As soon as the fixes became available, our team got to work incorporating them into PanelAlpha and testing the updated builds. PanelAlpha v1.9.8.3 is now available, along with security updates for both supported generations of PanelAlpha Engine.
We know how important it is to keep the services you manage secure, especially when news like this breaks. Our priority was to get the updated versions into your hands as quickly as we could, while making sure they were ready to use. We recommend updating as soon as possible.
These vulnerabilities affect PHP itself, rather than a flaw specific to PanelAlpha or its WHMCS integration. Still, PHP can run in several different parts of your setup, so it is important to update each relevant component.
The PHP vulnerabilities, in brief
Two critical vulnerabilities that can allow unauthenticated remote code execution on affected PHP servers.
CVSS v4.0
9.2 / 10
Vulnerability
CVE-2026-109618
Out-of-memory handling can leave internal PHP request data in an invalid state.
CVE-2026-109619
Internal request state may be reused after its memory has been freed.
Patched PHP versions
8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
Older PHP branches require an appropriate security backport from your vendor or an upgrade to a supported version.
More details: Official PHP security advisory →
Security updates are ready, here is what to do
We have released the following versions with the PHP security fixes. Please update the products you use, and check the notes below before you begin.
PanelAlpha Control Panel → update to v1.9.8.3
Back up your server and database, review the changelog, and make sure you have root SSH access and your license key. Then connect to the PanelAlpha server and run the update command below. The installer detects your existing installation and updates it.
UPDATE COMMAND
curl -fsSL https://get.panelalpha.com/app | shFor system requirements and troubleshooting, follow the PanelAlpha update guide.
PanelAlpha Engine 1.x → update to v1.0.23.1
Back up your server and data and check the changelog before proceeding. Connect as root, download the updater and run it with your PanelAlpha license key. Services may restart briefly, so plan for possible downtime. Afterwards, check the server status in PanelAlpha and create a test instance.
UPDATE COMMAND
wget -N -P /opt/panelalpha https://license.panelalpha.com/engine-updater.sh
bash /opt/panelalpha/engine-updater.sh --key 'YOUR_LICENSE_KEY'See the Engine 1.x update guide for the complete procedure and recovery instructions.
PanelAlpha Engine 2.x → update to v2.1.2.1
On your Engine VPS, sign in as root and note your current version with pae system:version. Run the update command below, then check the version again and open one of your websites to confirm it works. The Engine restarts during the update, but existing hosted websites are not rebuilt.
UPDATE COMMAND
curl --proto '=https' -fsSL https://get.panelalpha.com/engine | shFull details are in the Engine 2.x update guide.
Important before updating
Using Control Panel with Engine. If you’re running both, please stick with Engine 1.x for now and update it to v1.0.23.1. We’re already working on a dedicated Control Panel update that will make it compatible with Engine 2.x.
WordPress sites need their own PHP updates. Updating PanelAlpha Engine will not automatically update the PHP version used by your existing WordPress sites. Sites still running an unpatched PHP build will remain at risk. Check and update the PHP version for each WordPress installation separately.
Where else to check PHP in your setup
Updating PanelAlpha and Engine takes care of their respective components, but it does not patch every PHP installation on your servers. These are the other places worth checking.
WHMCS and the PanelAlpha module for WHMCS
WHMCS usually runs on a different server from PanelAlpha and uses that server’s PHP installation. You or your hosting provider will need to patch that PHP separately. PanelAlpha WordPress Hosting For WHMCS module supports PHP 8.2 and 8.3, but please check that your WHMCS version, ionCube Loader and other dependencies support the patched build before switching.
PHP sites hosted on PanelAlpha Engine
Each PHP project has its own PHP environment, which may need a separate update or rebuild depending on how the project is deployed. Check traditional and container-based projects, and do not forget cron jobs: they may use a different PHP version from the website. Updating the panel or Engine itself does not automatically patch PHP inside every existing project.
Security cheat sheet for admins
- Make a list of everywhere PHP is running, including WHMCS, customer sites and less obvious services such as billing cron jobs or a status page.
- Check the PHP version used by each website and by its cron jobs. They are not always the same.
- Make sure each PHP environment receives an officially patched build. The patch level matters more than the version number alone.
- Check compatibility with WHMCS, ionCube Loader, PHP extensions and any integrations you depend on.
- Back up your files, configuration and databases. Test in staging first if you can. PanelAlpha Engine lets you create a staging copy of a project, including its databases.
- If your hosting provider manages PHP for you, ask them to confirm when the security update has been applied.
- Apply the available updates promptly, then verify the versions and test the services you rely on.
Check that everything still works
Once you have updated, test every single flow your team and customers rely on every day: admin and client logins, checkout, invoices, payments, cron jobs and API integrations. If you use the WHMCS module, also check account creation, suspension, unsuspension, termination and single sign-on to the panel. Finally, look through the error logs. A page loading normally is a good start, but it does not tell you that everything behind it is working.
A few more security checks worth making
These checks do not replace the PHP fixes, but they are still worth doing while you are reviewing your setup.
- Review administrator accounts and remove access that is no longer needed.
- Enable two-factor authentication wherever it is available.
- Keep management interfaces, including databases, phpMyAdmin, SFTP and the Engine API, off the public internet wherever possible.
- Make sure you can restore your backups, not just create them.
Sources
Questions, Concerns, Anything?
Not sure about an update, worried about your setup, or just want to double-check something? Come chat with us on Discord. We’re always happy to help you figure things out, so don’t hesitate to reach out whenever you need us.
Join us on Discord →
Comments