Update your PHP ASAP 🚨

Two critical PHP vulnerabilities, both rated 9.2 (CVSS v4.0)

"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available."

https://www.php.net/archive/2026.php#2026-10-20-1

PHP2Shell
https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/

and, if you haven't already, now may be a good time to change to:

https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

This is urgent: Could someone from the CWP team let us know when updated PHP packages will be released?
For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33.

It is critical that CWP makes the latest upstream PHP releases available promptly.

There are some suggested mitigation actions to take while we wait for new PHP versions

Update php.ini with (hopefully you don't use it)
session.upload_progress.enabled = Off

update .htaccess with
RewriteEngine On

#PHP2SHELL
RewriteCond %{REQUEST_METHOD} ^POST$ [NC]
RewriteCond %{HTTP:Content-Type} ^[[:space:]]*multipart/form-data([;,[:space:]]|$) [NC]
RewriteRule ^ - [F,L]

Add custom WAF rule
# Detect and block the PHP2Shell upload progress exploit vector
SecRule ARGS_POST_NAMES "@streq PHP_SESSION_UPLOAD_PROGRESS" \
    "id:10033,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    severity:CRITICAL,\
    t:none,\
    msg:'PHP session upload progress field exploit attempt (PHP2Shell CVE-2026-109618/109619)'"

There are some suggested mitigation actions to take while we wait for new PHP versions

Update php.ini with (hopefully you don't use it)
session.upload_progress.enabled = Off

update .htaccess with
RewriteEngine On

#PHP2SHELL
RewriteCond %{REQUEST_METHOD} ^POST$ [NC]
RewriteCond %{HTTP:Content-Type} ^[[:space:]]*multipart/form-data([;,[:space:]]|$) [NC]
RewriteRule ^ - [F,L]

Add custom WAF rule
# Detect and block the PHP2Shell upload progress exploit vector
SecRule ARGS_POST_NAMES "@streq PHP_SESSION_UPLOAD_PROGRESS" \
    "id:10033,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    severity:CRITICAL,\
    t:none,\
    msg:'PHP session upload progress field exploit attempt (PHP2Shell CVE-2026-109618/109619)'"

This can help, but have been already confirmed that do NOT fix the vulnerability.
The only fix is update the PHP when the new version is released.

This is urgent: Could someone from the CWP team let us know when updated PHP packages will be released?
For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33.

It is critical that CWP makes the latest upstream PHP releases available promptly.

From the history... you can wait several weeks. 🤷‍♂️

And its on 🚨

https://www.php.net/archive/2026.php#2026-10-21-5

CWP still doesn't have the update

I don’t want to speak out of turn again, but I have some test VPS instances running the KeyHelp and HestiaCP panels, where security patches have already been applied. With CWP, not only are updates missing, but it’s not even possible to upgrade to PHP versions 8.2 or 8.3—and here I’m referring specifically to what kandalf mentioned: "For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33."

How are you guys dealing with this situation? We haven’t had any meaningful updates or changelog information from CWP since version 1.12.

Is the CWP team on vacation, or are they even aware of the PHP version issue? ))

Some info would be nice.

I pulled all CWP servers offline waiting for an update. But I can't do that for very long.

Another concern is the CWP internal PHP version, I think one of my CPW servers still runs on 7.1 internaly.

Some info would be nice.

I pulled all CWP servers offline waiting for an update. But I can't do that for very long.

Another concern is the CWP internal PHP version, I think one of my CPW servers still runs on 7.1 internaly.

Hi,

I have a question regarding the PHP version used by CWP internally.

Did you manage to upgrade the internal PHP version used by CWP itself from PHP 7.1 to PHP 8.x, so that the entire CWP panel and its internal services run on PHP 8.x? Or did you only change the PHP version used by websites and services such as Roundcube, while CWP itself still runs on PHP 7.1?

I noticed that some internal CWP configuration files still reference paths such as /usr/local/cwp/php71/, even when PHP 8.x versions are installed.

Could you please clarify what you changed and whether it is possible to upgrade CWP's internal PHP version safely?

Thank you!

Currently, there is nothing that can be done, only the CWP team can update on this - and if history told us something is that, probably, the reply will be too little, too late.

Every single CWP server is currently vulnerable. And CWP team will only deploy an update several days (or weeks) after - leaving a BIG gap to every server be attacked.

This is a PHP vulnerability, but CWP is COMPLETLY responsible for the damage that is being done from the lack of information.

Let’s hope the security solution protecting our servers will block attacks this time as well.

It’s really disappointing to see CWP falling behind when it comes to keeping the control panel up to date and secure. I’ve raised these concerns repeatedly on the forum, and I apologize if I sound frustrated, but it’s becoming increasingly difficult to remain patient.

As I’ve mentioned before, I have 25 CWP Pro servers running in production, and I’ve been using CWP for almost 10 years now, if I remember correctly. I genuinely want to see the project succeed, which is why these security issues and delays are so frustrating.

It’s really disappointing to see CWP falling behind when it comes to keeping the control panel up to date and secure. I’ve raised these concerns repeatedly on the forum, and I apologize if I sound frustrated, but it’s becoming increasingly difficult to remain patient.

As I’ve mentioned before, I have 25 CWP Pro servers running in production, and I’ve been using CWP for almost 10 years now, if I remember correctly. I genuinely want to see the project succeed, which is why these security issues and delays are so frustrating.

Same feeling.

If you have, use Cloudflare. They have released a WAF rule to protect - doesn't solve the issue, since is needed a PHP update, but can protect something for Cloudflare enable websites.

I contacted support about this and their response was -

"Hello,
we are working with PHP issue. It will be fixed in a future release.
Regards,
Igor S."


My guess is sadly no time soon. I'm already looking into migration options away from CWP.

If you have, use Cloudflare. They have released a WAF rule to protect - doesn't solve the issue, since is needed a PHP update, but can protect something for Cloudflare enable websites.

If I'm right the Cloudflare WAF is only available with enterprise plans, not on the free tier?