Critical PHP vulnerability patch?

[ssuess]

I have been reading this morning about a very serious critical bug in php: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities

Will easyengine be releasing an update, or should we try to build the patch version on our own? Any advice?

Thanks

[mrrobot47]

Thanks for flagging this.

Yes, we'll be doing a release for it. PHP is publishing the fixed versions today (2026-10-21, 14:00 UTC). Once the official PHP Docker images with the fix are out, we'll rebuild the EasyEngine PHP images (8.2, 8.3, 8.4 and 8.5) on them and ship a new EasyEngine release that moves existing sites to the patched images. You won't need to build anything yourself; ee cli update will pick it up, and we'll post here when it's out.

PHP 8.1 and older are end of life upstream and aren't expected to get this fix, so if you have sites on those versions, we recommend moving them to PHP 8.2 or newer.

Until the release is out, keep an eye on your sites' access and PHP-FPM logs, and if you run anything that exposes PHP directly (outside EasyEngine's nginx), consider restricting it for now.

[mrrobot47]

EasyEngine v4.13.3 is out: https://github.com/EasyEngine/easyengine/releases/tag/v4.13.3
https://easyengine.io/blog/easyengine-v4-13-3-php-security-update/

Run ee cli update on every server. It moves every enabled site on PHP 8.2, 8.3, 8.4 and 8.5 to rebuilt images with PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, which fix CVE-2026-109618 and CVE-2026-109619. Check a site with ee shell example.com --command='php -v'.

• Disabled sites keep their old image until you enable them with ee site enable example.com --refresh.
• As PHP's advisory recommends, the update also turns off session.upload_progress.enabled on every WordPress and PHP site on Linux, on all PHP versions. WordPress doesn't use it. If your app needs it, set it back to On in the site's custom.ini and run ee site reload example.com.
• PHP 8.1 and older got no official PHP release, so move those sites to PHP 8.2 or newer: ee site update example.com --php=8.4 (back up first).

The release took longer than planned because pecl.php.net, where our PHP images get several extensions, was returning errors for about an hour after the official PHP images came out. We waited for it to recover and checked every image before releasing.

[ssuess]

thanks!!!