PHP 8.2 to 8.5 version update

TuxCare has now updated its packages using the versions released by the PHP project, in addition to the backported fixes already deployed. The versions installed on our hosting platforms are:

• `alt-php82`: `8.2.35-1`
• `alt-php83`: `8.3.36-1`
• `alt-php84`: `8.4.27-1`
• `alt-php85`: `8.5.12-1`

The relevant security fixes were already present in the previous packages. This update brings the version numbers into line with those of the PHP project. It does not change the protection already provided against the vulnerabilities announced on 20 October.

Additional recommendation from the PHP project

In its 23 October advisory on session upload progress, the PHP project recommends disabling `session.upload_progress.enabled` until the next bugfix release.

This recommendation has already been applied across all our web hosting platforms, with `session.upload_progress.enabled = 0`. We are keeping this preventive measure in place while awaiting the announced fix.

No action is required on your part in Plesk or on your websites. The maintenance remains complete.

This morning, we received several questions about the PHP version number displayed in Plesk. Here is some clarification on the fixes that have been deployed.

The fixes for the vulnerabilities announced on 20 October have already been applied to all "Secured" PHP versions offered on our hosting platforms. No action in Plesk is required.

TuxCare ELS applies these fixes through backporting: the affected code is fixed without necessarily changing the PHP version number displayed. Fixes are tracked through the package revision and its security changelog. An older version number therefore does not mean that the fixes are missing.

For example, PHP 8.3.35 Secured includes the relevant fixes released in PHP 8.3.36. You do not need to change your site's PHP version in Plesk to benefit from them.

Command-line usage

The PHP interpreter called by default with the `php` command also includes these fixes. However, we recommend using the full path corresponding to your site's PHP version to maintain the same compatibility when running scripts, scheduled tasks or Composer commands.

For example, for a site running PHP 8.4: `/opt/plesk/php/8.4/bin/php`.

For more information:

• PHP updates and security with TuxCare ELS
• SSH access and PHP paths on Plesk hosting

The maintenance is complete. This update provides clarification on the fixes already deployed.

FRWEB14: fixed. Sites on this platform now run on PHP versions 7.4 to 8.5 patched against both vulnerabilities.

All our shared web platforms now use patched PHP versions. No action is required on your part

PHP 8.0 and 8.2: patched on FRWEB5 to FRWEB12 and CHWEB1. Our partner published these last two fixes shortly after midnight, and we installed them immediately, with no impact on the sites.

All PHP versions from 7.4 to 8.5 are now patched on FRWEB5 to FRWEB12 and CHWEB1.

FRWEB14: the patched versions of PHP 7.4 to 8.5 are installed, and we are currently finalizing their deployment on the sites on this platform.

No action is required on your part. Next update at the end of the work on FRWEB14.

PHP 8.5: fixed on FRWEB5 to FRWEB12 and CHWEB1. Our partner published the fix at 23:38, and we installed it immediately, with no impact on the sites.

Status of PHP versions on our shared web platforms:
- PHP 7.4, 8.1, 8.3, 8.4 and 8.5: fixed on all platforms except FRWEB14, which is waiting for the fixes to be published for its system.
- PHP 8.0 and 8.2: pending fixes from our partner. They will be installed automatically as soon as they are published. Until then, the application firewall blocks known attacks.

Next update when the final fixes are published.

Maintenance and deployment operations continue, as security patches are released by our patch provider.

In parallel, our teams maintain a very high level of vigilance on the subject, and we continue to deploy numerous WAF rules to limit any exposure, as the observed attack vectors evolve.

Maintenance is complete.

PHP 8.4: fixed on FRWEB5 to FRWEB12 and CHWEB1. Our partner published the fix at 22:10, and we installed it immediately, with no impact on the sites.

Where the PHP versions on our shared web platforms stand:
- PHP 7.4 and PHP 8.4: fixed on all platforms except FRWEB14, which is waiting for the fixes to be published for its system.
- PHP 8.0, 8.1, 8.2, 8.3 and 8.5: awaiting our partner's fixes. They will be installed automatically as soon as they are published. Until then, the application firewall blocks known attacks.

FRWEB4: the sites hosted on this platform run PHP 7.4, in a version fixed against these two vulnerabilities. As FRWEB4 is an older platform, our teams plan to migrate its sites to a fully maintained platform.

Next update when the other PHP 8.x fixes are published.

Web application firewall (WAF): at 19:17, our partner published new rules. They block other variants of the attack tool and detect malformed file uploads used to exploit these vulnerabilities. These rules are active on all our shared web platforms.

Status of PHP versions on our shared web platforms:
- PHP 7.4: fixed on all platforms except FRWEB14, which is awaiting the release of the fix for its system.
- PHP 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5: pending. Our partner announces the fixes around 22:00. They will be installed automatically as soon as they are published. Until then, the web application firewall blocks known attacks.

Next update upon the release of the PHP 8.x fixes.

The PHP Foundation released this afternoon the fixes for vulnerabilities CVE-2026-109618 and CVE-2026-109619 for PHP 8.2, 8.3, 8.4 and 8.5. Versions 7.4, 8.0 and 8.1 are fixed by our partner maintenance program.

Protection status of our shared web platforms (FRWEB5 to FRWEB12, FRWEB14, CHWEB1):

• Web application firewall (WAF): blocking rules for known attacks have been active on all these platforms since last night.
• Maintained PHP versions: all sites have been switched to PHP versions maintained and continuously patched by our partner, from PHP 7.4 to PHP 8.5, without changing the version for your sites.
• PHP 7.4: fixed on FRWEB5, FRWEB6, FRWEB7, FRWEB8, FRWEB9, FRWEB10, FRWEB11, FRWEB12 and CHWEB1. FRWEB14 will be fixed as soon as the patch for its system is released.
• Webmails: fixed on all platforms.
• PHP 8.0 to 8.5: the fixes are expected this evening. They will be deployed automatically as soon as they are released.
• Plesk administration panel: the vendor has announced a fix for today. It will be applied as soon as it is available.

These deployments are performed transparently. Short interruptions of a few seconds to a few minutes may have occurred on some sites.

The PHP Foundation announced last night the discovery of two critical security vulnerabilities in the PHP project, affecting all PHP versions since PHP 5.0: CVE-2026-109618 and CVE-2026-109619. These security vulnerabilities are directly related to PHP and potentially allow taking control of any website running PHP, regardless of its configuration.

The exact details of these vulnerabilities have not yet been published: The PHP Foundation announced the publication of details for today at 4 PM (Paris time) along with the first security patches.

Nevertheless, some elements are already anticipated regarding these vulnerabilities: They would affect all PHP versions since PHP 5.0 (since 2004), and the PHP Foundation would only provide patches for sites running PHP 8.1, 8.2, 8.3, 8.4 and 8.5.

Our team has conducted a full audit of our shared WEB infrastructures (Plesk), primarily affected by these vulnerabilities, due to the very high number of websites using PHP on these platforms. We also deployed during the night a first batch of security patches (including dynamic WAF firewalling rules), aimed at reducing our clients' exposure to these vulnerabilities.

We will also deploy the security patches for PHP versions 8.1, 8.2, 8.3, 8.4 and 8.5 as soon as they are published by the PHP version.

Finally, we also plan security patches for PHP versions 7.4, 8.0 and 8.1: These versions are EOL, but are still offered on our infrastructures, and receive regular security patches via a partner maintenance program. We estimate that these patches will be available very quickly after the publication of patches for more recent PHP versions.