Critical PHP updates

[exlhost]

A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.

You really are a G.O.A.T. serious legend from DA, you were one of the first with everything patched and backported up to 7.4 today.

 

[hlt]

A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.

I have 74 servers with DA, most of them are AlmaLinux 8/9 and they got updated... Please provide 5.6 fix for CentOS 7 DA v1.668 if possible. I have about 12 servers still running legacy DA. Thank you!

 

[Daku]

All of us now summoning Demon

 

[altayevrim]

A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.

Thank you very much <3 I reactivated the sites I shut down

 

[exlhost]

I have 74 servers with DA, most of them are AlmaLinux 8/9 and they got updated... Please provide 5.6 fix for CentOS 7 DA v1.668 if possible. I have about 12 servers still running legacy DA. Thank you!

CentOS 7 is old men, really inplace upgrade asap to alma 8/9.

 

[hlt]

CentOS 7 is old men, really inplace upgrade asap to alma 8/9.

I will do ASAP, but every server is ~400 GB MySQL database and if 5.6.40 got fixed on AlmaLinux, maybe same can be applied to CentOS at least till all gets updated. Hope this happens

 

[Michel Vink]

A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.

I managed to install this patch for the 5.6 version, but am still getting errors on trying to update 8.1.
All other updates and patches were succesfull including more recent versions of PHP, like 8.3 and 8.4

download_cached: using cached '/usr/local/directadmin/custombuild/cache/php-8.1.25.tar.gz' file
Patching PHP 8.1 ...
patching file ext/xml/compat.c
Hunk #1 FAILED at 376.
1 out of 1 hunk FAILED -- saving rejects to file ext/xml/compat.c.rej
patching file ext/xml/tests/gh14834.phpt
patch_dir_apply: failed to apply '/usr/local/directadmin/custombuild/patches/php-8.1/001-libxml2-with-pear-compat.patch' patch
install_php: failed to compile '/usr/local/directadmin/custombuild/cache/php-8.1.25.tar.gz' inside '/usr/local/directadmin/custombuild/tmp/tmp.VmFvkaAWkN.php-8.1.25.tar.gz'

 

[lyes.2k]

A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.

Thank's, I can confirm the small 8.1 fix went well this time!

 

[altayevrim]

I will do ASAP, but every server is ~400 GB MySQL database and if 5.6.40 got fixed on AlmaLinux, maybe same can be applied to CentOS at least till all gets updated. Hope this happens

I was thinking like you too but eventually a day will come and we will have to move forward.

Today I saw that with the help of AI, I could easily upgrade a 10 years old script to PHP8.4 from PHP7.2 that I was delaying for years.
Within a week or so I'm planning to upgrade them all and drop 7.x completely (I have 7.2 and 7.4 both unfortunately).

 

[DrWizzle]

I will do ASAP, but every server is ~400 GB MySQL database and if 5.6.40 got fixed on AlmaLinux, maybe same can be applied to CentOS at least till all gets updated. Hope this happens

I've never really liked CentOS. Alma isn't bad, but Debian/Ubuntu is my go to OS.

 

[Strator]

A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.

Just to clarify - the 8.0.30* version included in the new update is patched as well?

 

[nathany]

Has anyone seen any patches actually available for CloudLinux 8 ? Their status site implies some PHP versions have been patched but nothing showing up here.

 

[DanielP]

And nobody should complaint about compiling versions,

@nathany
Cloud Linux still wait only EL versions that came with imunify

Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 14:00 UTC

CloudLinux's Status Page - Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 14:00 UTC.

cloudlinux.statuspage.io

I heard remi will receive updates tomorrow

 

[bbytes]

I still consider this a temporary fix. Or can we conclude this is a permanent solution? I'm still pushing developers to upgrade their websites to 8.3 or higher, which is still good. But i would like to give them more time.

 

[ViAdCk]

A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.

Thanks! We have some servers running centos7. Can we expect patches or how can we apply the patches ourselves if you don't offer them?

 

[Strator]

Just to clarify - the 8.0.30* version included in the new update is patched as well?

Found the patch file in the custombuild folder, so the answer is yes. Thank you!

 

[exemaco]

Thanks! We have some servers running centos7. Can we expect patches or how can we apply the patches ourselves if you don't offer them?

We are waiting for a patch for RH7

 

[infracom2005]

some files of difrectadmin server works slow or time out? I have problems with ioncube update in 6 servers

[1mUpdating ionCube PHP 8.1 extension(B[m
download_cached: downloading 'https://files.directadmin.com/services/ioncube_15.5.1/ioncube_loaders_lin_x86-64.tar.gz' to '/usr/local/directadmin/custombuild/cache/ioncube_loaders_lin_15.5.1_x86-64.tar.gz'
#=#=#

mainly with 8.1 and 8.3

 

[Hosted Power]

@ViAdCk @exemaco for CentOS 7 boxes that won't get a vendor patch: our extension (now v3.1.0) mirrors the official fix on an unpatched PHP and supports DirectAdmin CustomBuild, including a post-build hook so a rebuild keeps it. It recognises patched builds and steps aside, so it's safe to keep once a patch does arrive. The prebuilt binaries need glibc 2.14 and CentOS 7 has 2.17, but we haven't tested on EL7 ourselves, so building from source with phpize is the safest route there.

GitHub - HOSTED-POWER/php_uploadprogress_guard: Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.

Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. P...

github.com

 

[Drakar]

Hi, I'm testing this on a new server running AlmaLinux 9 with the latest DirectAdmin version.

When I run `da build versions`, I get:

Latest version of PHP 7.4: 7.4.33
Installed version of PHP 7.4: 7.4.33

I don't see any asterisk (*) indicating that security patches have been applied.

How can I verify if PHP 7.4.33 is actually patched? Is there another way to check?