v1.28.1 — Hotfix: PHP security updates for MultiPHP versions

Hotfix: PHP security updates for MultiPHP versions

PHP released fixes today for CVE-2026-109618 and CVE-2026-109619: critical, unauthenticated remote code execution affecting every PHP version up to 8.5.11, including PHP-FPM, which every iNetPanel site and the panel itself run on. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which sury.org already publishes for Debian 12 and 13.

What to do on every iNetPanel server

1. Update iNetPanel to 1.28.1 (Settings → Updates, or inetp panel_update).
2. Run inetp update as root. It installs the fixed PHP packages; PHP-FPM restarts on its own.

If you skip step 2, the nightly system update (00:00 by default) installs them. Check what you are running with dpkg -l 'php*-fpm' | grep ^ii.

What this release fixes

On servers installed with iNetPanel 1.26.0 or later, a PHP version added through MultiPHP never received updates. The installer's pin that stops a second PHP stack being pulled in also blocked upgrades of versions installed on purpose, so sites on those versions would have stayed on the vulnerable build. The nightly update (inetp update) now lets every installed PHP version update from sury, while versions that are not installed stay blocked. Servers installed before 1.26.0 were not affected by this. The panel's own PHP version was always updated normally.

PHP 8.1 and older cannot be fixed

php.net has released no fix for PHP 8.1 or older, and none is available from sury. Move any site on PHP 5.6–8.1 to PHP 8.2 or later (Multi-PHP → Per-Domain PHP Version).