Security notice: PHP CVE-2026-109618 & CVE-2026-109619

On October 21, the PHP project shipped an emergency security release for two critical vulnerabilities in the PHP interpreter itself, sometimes referred to as “PHP2Shell”:

• CVE-2026-109618: remote code execution through out-of-memory corruption
• CVE-2026-109619: remote code execution through stale global state

Both are rated 9.2 (CVSS v4.0) and can let an unauthenticated attacker run code on an affected server. Details leaked before the fix was released, so please treat this as urgent.

What we’ve done

Unicorn Panel has shipped the PHP builds (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for all supported runtimes. We've also manually patched PHP 8.1, PHP 8.0, and PHP 7.4.

v1.0.17 also brings the CVE fixes to the control panel which can only be done by upgrading to the latest version. v1.0.16 put in place a temporary fix and a new command X unicorn cp rebuild-container  to rebuild the control panel prior to v1.0.17. Once your fleet is on 1.0.17, your control panels on the fleet are protected. Once you upgrade the roles in your fleet, your sites are protected.

Patched PHP versions in Unicorn Panel

PHP 8.1, 8.0 and 7.4 are end-of-life and received no upstream fix. The -R1 builds are fixes we backported ourselves and ship only with Unicorn Panel. We are looking into the possibility of patching 5.6, 7.0, 7.1, 7.2, and 7.3.

What you need to do

1. Navigate to Servers where a version check will be performed for each server in your fleet.
2. If you’re below 1.0.17, run the fleet-wide upgrade from the Primary panel so every Secondary server picks up the new version.
3. Navigate to Servers and perform a fleet wide role upgrade using the button Upgrade All Roles
   
4. Confirm each web server reports the new PHP version for its sites.

If you can’t upgrade immediately, PHP has published partial mitigations, but they don’t close every exploit path. Updating is the only complete fix.

Questions? Reply below or open a ticket.