On October 21, 2026, PHP officially released a security advisory confirming two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Attackers may be able to trigger the vulnerabilities through specific requests without logging in to the website backend, causing PHP to execute attacker-controlled code. PHP officially released fixed version 8.3.36 for PHP 8.3 and recommends that users update as soon as possible.View the official PHP security advisory。
What impact do these vulnerabilities have?
PHP is the program used to run WordPress websites. WP Panel deploys PHP 8.3 according to the official installation script and handles requests for websites through PHP-FPM. This issue lies in PHP itself, not in a WordPress plugin or theme.
If an attacker successfully exploits the vulnerability, they may gain further control over the PHP process handling requests. WP Panel uses a separate system user and PHP-FPM pool for each website, which helps limit the impact of one website on others, but this cannot replace updating PHP, nor can it guarantee that no damage occurs after exploitation.
Discovering a vulnerability does not mean your server has been compromised. It means that servers running affected PHP versions need to install the fix package as soon as possible. Updating only the WordPress core, plugins, or themes cannot fix the issue in PHP itself.
What should WP Panel users do now?
- Log in to WP Panel and open „Settings → System Update“.
- Click „Refresh“ to view packages that can be updated. Starting from WP Panel v1.9.0, „Refresh“ first updates the package index of the software sources, then re-checks the list, so what you see is the result currently provided by the software sources; it is still only a check and will not install updates. If there are updates in the list, click the „One-Click Update“ button, wait for the background task to finish, and pay attention to the result or restart prompt displayed on the page.
- After updating, check the PHP-FPM version in „Software Management“. WP Panel uses PHP 8.3, and the corresponding official fixed version is 8.3.36. The package version may be followed by additional markers from Debian or the software repository.
In v1.8.0 and earlier versions, „Refresh“ only read the package list currently saved by the system (to reduce load, the panel caches results for up to 5 minutes), so „Up to date“ did not necessarily mean there were really no updates in the software sources. v1.9.0 (released on October 22, 2026) improves this: clicking „Refresh“ first updates the software source index and then queries; the panel also automatically refreshes once a day and checks for updates, with the latest time, result, and count displayed in the „Settings → System Updates“ card. It is recommended to upgrade the panel first and then verify (v1.9.0 has no database schema changes and can be upgraded directly); if you do not upgrade for now, „Up to date“ may still simply mean the software source index is too old, so please manually verify the PHP-FPM version.
Regardless of the version, when actually executing „One-Click Update“, WP Panel will refresh the software sources, first perform a complete upgrade simulation, and only actually install after confirming that the upgrade plan will not remove packages, preserving existing configurations and checking each service after completion. We verified this on a Debian server installed with the official WP Panel script: after updating the package index of the official Sury PHP source, the system update simulation result included PHP 8.3.36 and was not blocked due to planned package removals. This is the result on that server at that time and does not represent the software source status of other servers.
If the system update does not update PHP
Different servers may use different software sources or mirrors; some mirrors sync later. If the system update page does not offer a PHP update, or PHP-FPM still shows the old version after the update completes, the vulnerability has not yet been fixed by this update. Please contact your server provider or WP Panel support, state the PHP version and system update result, and ask them to confirm whether the software source already contains the fix package.
Do not download PHP installation packages from unfamiliar websites, and do not change software sources or copy temporary configurations found online for this vulnerability. PHP officially states that configuration adjustments can only reduce the risk of some attack paths and cannot replace installing the fixed version.PHP Official Announcement and Update Recommendations
In short: „Refresh“ is not an install button. Starting from v1.9.0, „Refresh“ first updates the software sources, making the „Up to date“ judgment more reliable; in older versions, „Up to date“ may simply mean the index is too old. After installation, you should still verify whether the PHP-FPM version includes the fix; if not, the mirror may not yet provide the fixed package, and the software source status needs further confirmation.
For details on this improvement to the system update check in the panel, see"WP Panel v1.9.0 Officially Released: System Updates Checked Automatically Every Day". v1.9.0 also adds an optional „Automatically install system updates when available“ switch, which is off by default; when enabled, such security updates will be installed automatically after being detected in the daily check, with the same removal protection and service checks retained.
