Enhance 12.26.1 and PHP CVE-2026-109618 or CVE-2026-109619

matrix

imreltd This is not always possible. We are a PrestaShop hosting. Migrating to upper PHP means migratis between ecommerce majow versions. Which means a compelte redo of a website which customers can't/won't pay now (and there is no reason to actually, since patches can be backported).

imreltd

matrix totally understandable. For now we decided not to do Presta haha. It's a nightmare imo

gary_influxology

Adam Thank you Adam and team for all you have done today!

Adam

Martijndort

Delete if from the website list and re-add it via settings->platform, that's the fastest way.

nick-a

Adam

Does that also work for webmail?

gary_influxology

Martijndort I asked this question today and Adam gave me this answer: Go to the website list, delete the phpMyAdmin website then add it again under settings->platform, it will be added with PHP 8.3.

cPFence

mendozal Is there some CLI command to quickly check all php versions used by websites?

You can use this command to list all primary domains along with their PHP versions and the server they're hosted on:

sudo -u postgres psql -X -P pager=off -d orchd -c "SELECT d.domain, COALESCE(w.php_version,'(none)') AS php, COALESCE(NULLIF(s.friendly_name,''),s.hostname) AS server FROM websites w JOIN servers s ON s.id=w.server_id JOIN domain_mappings dm ON dm.website_id=w.id AND dm.kind='primary' JOIN domains d ON d.id=dm.domain_id WHERE w.kind=0 AND w.soft_deleted_at IS NULL ORDER BY php, d.domain;"

Alternatively, you can find the same information in your cPFence webui > Tools & Utilities, where you can also use bulk actions to change PHP versions across multiple websites quickly.

ferrokot

cPFence cPFence webui > Tools & Utilities
but only for live domains and not for staging =)

Splunge

zennix That's the PHP CLI version probably, not the PHP-FPM version. Use the code:

sudo -u postgres psql -X -P pager=off -d orchd -c "SELECT d.domain, COALESCE(w.php_version,'(none)') AS php, COALESCE(NULLIF(s.friendly_name,''),s.hostname) AS server FROM websites w JOIN servers s ON s.id=w.server_id JOIN domain_mappings dm ON dm.website_id=w.id AND dm.kind='primary' JOIN domains d ON d.id=dm.domain_id WHERE w.kind=0 AND w.soft_deleted_at IS NULL ORDER BY php, d.domain;"

that was kindly supplied earlier in the thread to provide a list of PHP versions you're running by cPFence : (Would look something like this)

       domain       |  php  |       server       

--------------------+-------+--------------------
 domain1.org.uk     | php83 | v7
 domain2.org.uk     | php83 | v7
 domain3.org.uk     | php83 | services
 domain4.org.uk     | php83 | sales
 domain5.org.uk     | php83 | customer-1
 domain6.org.uk     | php83 | sales
 domain7.org.uk     | php83 | services
 domain8.org.uk     | php84 | fc.myserver.co.uk
 domain9.org.uk     | php84 | services
 domain10.org.uk    | php85 | v7
 domain11.org.uk    | php85 | v7
 domain12.org.uk    | php85 | Master server
(12 rows)

webnestify

Damn! The download speed of the packages is terrible... to many people at the same time...keep on pushin

mendozal

Thank you @cPFence @Machiel92
Upgraded and moved some sites to newer versions.

mendozal

nick-a After upgrade and ecp restart-php. I noticed that webmail running with roundcubelocal is running on 8.2.35 in my cluster.

Peertje

ecp restart-php

what to do on a server with mail and roundcube where the restart is stuck or does not happen

Adam

Peertje

If ecp restart-php hangs, run systemctl restart appcd and try again.

nqnoc

On an OpenLiteSpeed node, Enhance's PHP is updated to 8.3.36, but the lsphp83 package from the LiteSpeed repository is still 8.3.35.
Anything else to do now? Will keep an eye when the LiteSpeed repository has 8.3.36.

Adam

nqnoc

That package is only used to serve the Litespeed admin panel which isn't open to the web by default. PHP for customer websites running under Litespeed or Openlitespeed is provided by Enhance and can be updated as above.

Dominic

nqnoc Was just gonna ask the same thing, assuming we need to wait for a update to be pushed out.

DracoBlue

mendozal That's strange, both phpMyAdmin and Roundcube work fine for me with PHP 8.3.

mendozal

DracoBlue did you do something special? I removed and re-added phpmyadmin and its running on 8.3 but all the mail.domain.com domains and roundcubelocal are running on 8.2.

I even restarted the server but it doesn't change. I believe there's no UI to change this.

imreltd

Thanks again @Adam and the team, all servers are now secured 🙂

dragon2611

Don't forget to change your package settings to stop customers self selecting back down to vulnerable versions if you don't want them to have that option.

Dominic

dragon2611 Good call!

« Previous Page Next Page »