[{"data":1,"prerenderedAt":291},["ShallowReactive",2],{"seo-verification":3,"blog-php2shell-cve-2026-109618-109619-patch-php-ma-en":6,"promo-bar-likely":290},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-php2shell-cve-2026-109618-109619-patch-php-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":228,"ctaBody":229,"ctaButton":230,"ctaUrl":231,"relatedPosts":232},489,"php2shell-cve-2026-109618-109619-patch-php",{"fr":12,"en":10,"ar":13,"es":14},"php2shell-cve-2026-109618-109619-mettre-a-jour-php","php2shell-cve-2026-109618-109619-تحديث-php","php2shell-cve-2026-109618-109619-actualizar-php","PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619","PHP2Shell: two critical PHP flaws exploitable without an account. Patched versions, update commands per system and temporary mitigations.",16,1,false,"2026-10-22T00:00:00+00:00","2026-11-08T01:13:15+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fphp2shell-cve-2026-109618-109619-mettre-a-jour-php-poster.svg","On 21 October 2026, the PHP security team issued emergency releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two flaws nicknamed “PHP2Shell”: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 under CVSS 4.0. They target the interpreter itself, not an application: a single anonymous HTTP request is enough, before your code even starts to run. Exploitation attempts have been observed since the very day of publication. Update of 27 October: CISA added both flaws to its Known Exploited Vulnerabilities catalog on 26 October. Here is what these two flaws do, how to find out whether your servers are exposed, and how to fix them on Debian, Ubuntu, RHEL, cPanel and Docker.",[35,39,48,52,55,64,67,97,100,116,119,137,140,168,180,183,186,189,192,195,198,213,222,225],{"type":36,"title":37,"body":38},"h2","Update of 27 October: CISA lists PHP2Shell among exploited flaws","On 26 October 2026, CISA, the US cybersecurity agency, added **both flaws** (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities (KEV) catalog. An entry appears there only once real-world exploitation is established: until now, that finding rested on watchTowr's network traps; it now comes from a public authority.\n\nCISA set the due date at 29 October 2026, three days after the addition. That date binds only US federal agencies, but it gives the order of magnitude of the urgency a public body attaches to these flaws: a few days, not the next monthly maintenance window.",{"type":40,"title":41,"items":42},"ul","What the KEV catalog entry says",[43,44,45,46,47],"**Date added**: 26 October 2026, for CVE-2026-109618 (“PHP Memory Corruption Vulnerability”) as well as for CVE-2026-109619 (“PHP Stale Internal Request-State Vulnerability”).","**Due date**: 29 October 2026 for both.","**Required action**: apply the vendor's mitigations in line with directive BOD 26-04 (Prioritizing Security Updates Based on Risk), or stop using the product if no mitigation is available.","**Forensic triage**: the entry points to CISA's “Forensics Triage Requirements”. Patching is not enough: you also need to look for a compromise that happened before the fix.","**Ransomware**: use in a ransomware campaign is listed as “unknown” so far.",{"type":49,"title":50,"body":51},"tip","What this changes for you","Nothing in the procedure: the fixed versions and the commands remain those of this article. What changes is the priority. Before 26 October you could still weigh “right now” against “at the next maintenance window”; that is no longer defensible. Internet-facing servers come first. And the question is no longer only “am I protected?” but “was I hit between 21 October and the moment I patched?”: the checklist further down has been extended accordingly.",{"type":36,"title":53,"body":54},"PHP2Shell at a glance","PHP2Shell is not a flaw in WordPress, Laravel or a plugin: the PHP engine itself is at fault. Every PHP application that answers web requests is therefore affected, whatever its code looks like. The security advisory names PHP-FPM, Apache with `mod_php`, `php-cgi`, FrankenPHP and LiteSpeed.\n\nBoth flaws share the same underlying mechanism. When PHP abruptly aborts a request (exhausted memory, fatal error), it can leave behind an internal state that is only half initialised or that has already been freed. A subsequent request, handled by the same PHP process, then reuses that state: this is what opens the door to remote code execution.",{"type":40,"title":56,"items":57},"Key takeaways",[58,59,60,61,62,63],"**CVE-2026-109618** — memory corruption when `memory_limit` is exceeded: request data that was only partially initialised is later treated as valid during the cleanup phase.","**CVE-2026-109619** — stale global state: state that belongs to one request survives after its memory has been freed and can be read by the next request on the same process.","**Score**: 9.2 out of 10 under CVSS 4.0 for each one, with no authentication and no user interaction required.","**Patched versions**: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project no longer publishes releases for 8.1 and the older branches.","**Exploitation**: watchTowr reports exploitation attempts caught in its network honeypots as early as 21 October 2026.","**Scope**: according to the NVD, CVE-2026-109619 affects every version since PHP 5.4.0, and CVE-2026-109618 every version since PHP 7.3.0.",{"type":36,"title":65,"body":66},"Why these two flaws are so dangerous","Most web flaws require a specific form, a user account or a vulnerable plugin. PHP2Shell needs none of that: the most common trigger is the processing of a `multipart\u002Fform-data` upload with session upload progress tracking (`session.upload_progress`), a mechanism that PHP enables by default and that runs **before** the first byte of your application. A web application firewall living inside your code, a WordPress security plugin or a Laravel middleware therefore all come into play too late.\n\nThe second factor is the execution model itself. PHP-FPM and Apache reuse the same process for hundreds of successive requests: this is precisely what allows a booby-trapped request to contaminate the next one. According to Imperva, the published techniques range from crashing processes to reading arbitrary files through the OPcache cache, including leaking around 67 KB of process memory inside an oversized `PHPSESSID` cookie. That memory can contain database passwords or API keys.",{"type":68,"title":69,"headers":70,"rows":74},"comparison","Which version to install for your branch",[71,72,73],"PHP branch","Patched version","What to do",[75,79,82,85,89,93],[76,77,78],"8.5","8.5.12","Update, then restart PHP",[80,81,78],"8.4","8.4.27",[83,84,78],"8.3","8.3.36",[86,87,88],"8.2","8.2.35","Update, then plan the migration to 8.3 or 8.4",[90,91,92],"8.1, 8.0, 7.4","No official release","Your distribution's patched package, a source backport, or else migration",[94,95,96],"7.3 and earlier, 5.x","No published fix","Migrate to a maintained branch",{"type":36,"title":98,"body":99},"Check whether your servers are exposed","Watch out for a classic trap: the version shown by `php -v` on the command line is not necessarily the one that serves your websites. A server can have several versions of PHP-FPM installed side by side, and each site can point to a different one. You therefore need to check the version that is actually served over the web, one site at a time.",{"type":101,"title":102,"steps":103},"steps","Take an inventory of the PHP versions being served",[104,107,110,113],{"title":105,"body":106},"List the installed versions","On Debian or Ubuntu:\n\n```bash\ndpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\\n' 'php*' | awk '$1==\"ii\"' | grep -E 'php[0-9.]+-(fpm|cli|common)|libapache2-mod-php'\n```\n\nOn RHEL, AlmaLinux or Rocky Linux:\n\n```bash\nrpm -qa 'php*' 'ea-php*' 'alt-php*' | sort\n```",{"title":108,"body":109},"Find the PHP processes that are running","```bash\nsystemctl list-units --type=service --state=running | grep -E 'php|apache2|httpd|lsws'\n```\n\nEvery active `phpX.Y-fpm` service is a version you need to check and to patch.",{"title":111,"body":112},"Read the version served by a site","Drop a temporary file at the root of the site, query it, then **delete it immediately** afterwards:\n\n```bash\necho '\u003C?php echo PHP_VERSION, \" \", PHP_SAPI;' > \u002Fvar\u002Fwww\u002Fmonsite\u002Fv-check.php\ncurl -s https:\u002F\u002Fmonsite.example\u002Fv-check.php\nrm \u002Fvar\u002Fwww\u002Fmonsite\u002Fv-check.php\n```\n\nA result such as `8.3.36 fpm-fcgi` indicates a patched version being served by PHP-FPM.",{"title":114,"body":115},"Check your Docker containers","```bash\ndocker ps --format '{{.Names}}' | while read c; do echo \"$c: $(docker exec \"$c\" php -r 'echo PHP_VERSION;' 2>\u002Fdev\u002Fnull)\"; done\n```\n\nA container without PHP shows nothing at all after its name.",{"type":36,"title":117,"body":118},"Apply the fix","Linux distributions and extended support vendors received the fixes ahead of the public release. The patched package from your distribution therefore does not necessarily carry the number 8.3.36: Ubuntu 24.04, for example, patches its own version 8.3.6 in the package `8.3.6-0ubuntu0.24.04.13`. Rely on your distribution's security advisory rather than on the PHP version number alone. In every case, **a restart is essential**: as long as the old processes keep running, it is the old code that answers your requests.",{"type":101,"title":120,"steps":121},"Update PHP for your environment",[122,125,128,131,134],{"title":123,"body":124},"Debian and Ubuntu","```bash\nsudo apt update\nsudo apt install --only-upgrade $(dpkg-query -W -f='${db:Status-Abbrev} ${Package}\\n' 'php*' | awk '$1==\"ii\"{print $2}')\nsudo systemctl restart 'php*-fpm'\nsudo systemctl restart apache2   # if you use mod_php\n```\n\nIf your versions come from a third-party repository (for example the `ondrej\u002Fphp` PPA), check that the version installed after the update really is one of the patched versions.",{"title":126,"body":127},"RHEL, AlmaLinux, Rocky Linux","```bash\nsudo dnf upgrade 'php*'\nsudo systemctl restart php-fpm\nsudo systemctl restart httpd\n```\n\nAlmaLinux published its patched packages on 21 October 2026. The community Remi repository, for its part, published versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 22 October 2026: if you depend on it, check the installed version afterwards.",{"title":129,"body":130},"cPanel server (EasyApache 4 or CloudLinux)","```bash\nsudo dnf upgrade 'ea-php*' 'alt-php*'\n\u002Fscripts\u002Frestartsrv_apache_php_fpm\n\u002Fscripts\u002Frestartsrv_httpd\n```\n\nOn an older server, replace `dnf` with `yum`. Then check each version in **WHM › MultiPHP Manager**: any account set to 7.3 or older, with no fix from cPanel, must be switched over to a maintained version; 7.4, 8.0 and 8.1 are fixed by backport but end-of-life (see below).",{"title":132,"body":133},"Docker containers","```bash\ndocker compose pull\ndocker compose up -d --force-recreate\ndocker compose exec app php -r 'echo PHP_VERSION;'\n```\n\nIf your `Dockerfile` starts from a `php:8.3-fpm` image, rebuild the image with `docker compose build --pull`: without `--pull`, Docker reuses the old base image that it has in its cache.",{"title":135,"body":136},"Check the result","Run the check from the previous step again on every site. The fix is only in place if the version **served over the web** is patched, not merely the version installed on disk.",{"type":36,"title":138,"body":139},"cPanel and EasyApache 4: an unchanged version number does not mean “not fixed”","The EasyApache 4 (EA4) changelog of 21 October 2026, version 25.91, covers seven PHP branches. For the maintained branches the number goes up: `ea-php82` moves from 8.2.34 to 8.2.35, `ea-php83` from 8.3.35 to 8.3.36, `ea-php84` from 8.4.26 to 8.4.27 and `ea-php85` from 8.5.11 to 8.5.12. For `ea-php74`, `ea-php80` and `ea-php81`, which cPanel has nonetheless declared end-of-life, the fix is **backported**: the PHP version number stays put and only the package revision changes.\n\nThat is the trap: `php -v` then shows an “old” version even though the code is fixed, and an old version whose changelog does not cite the two CVEs remains vulnerable. Only reading the package changelog settles it. A version 25.92, released the same day, also rebuilt the meta-packages so that their changelog mentions the backport too.",{"type":68,"title":141,"headers":142,"rows":146},"EasyApache 4 25.91: what cPanel published, package by package",[143,144,145],"Package","What changed","How to check",[147,151,154,157,160,164],[148,149,150],"ea-php85","8.5.11 to 8.5.12","Package version",[152,153,150],"ea-php84","8.4.26 to 8.4.27",[155,156,150],"ea-php83","8.3.35 to 8.3.36",[158,159,150],"ea-php82","8.2.34 to 8.2.35",[161,162,163],"ea-php81, ea-php80, ea-php74","Fix backported, PHP number unchanged","RPM changelog: look for both CVEs",[165,166,167],"ea-php73 and older","No entry in the 25.91 changelog","Migrate, or see CloudLinux below",{"type":101,"title":169,"steps":170},"Check that a backported package really is fixed",[171,174,177],{"title":172,"body":173},"Read the EasyApache package changelog","```bash\nrpm -qa 'ea-php*-php-cli'\nrpm -q --changelog ea-php81-php-cli | grep -E 'CVE-2026-(109618|109619)'\n```\n\nThe first command lists the installed branches; replay the second for each one. A line citing the CVEs confirms the fix. No line at all: the package is not fixed, whatever its version number.",{"title":175,"body":176},"Do the same for alt-php packages","On a CloudLinux server, the versions chosen in **Select PHP Version** are `alt-php` packages:\n\n```bash\nrpm -q --changelog alt-php85-common | grep -E 'CVE-2026-(109618|109619)'\n```",{"title":178,"body":179},"Go through the accounts one by one","In **WHM › MultiPHP Manager**, every domain must point to a branch whose package passed this check. The 7.4, 8.0 and 8.1 branches fixed by backport remain end-of-life: they are a holding position, not a destination.",{"type":36,"title":181,"body":182},"CloudLinux: the same fix, one to two days later depending on the product","CloudLinux publishes its own packages, and they do not arrive at the same time as cPanel's. According to its bulletin, the `ea-php` packages (5.2 to 8.5) reached stable on 21 October, the `alt-php` ones on 22 October for CloudLinux 7, 8 and 9, the system's native PHP late on 22 October (UTC), and the packages numbered like PHP.net on 23 October.\n\nThese too are backports: `ea-php84` there stays, for instance, at 8.4.26 with a CloudLinux-specific revision (8.4.26-2) while being fixed. Two points of caution: on 21 October, `alt-php` packages announced as released were in fact in the TuxCare ELS repository and not in CloudLinux's own; and the advice to disable the `php-els` repository, given on 22 October, was corrected on the evening of the 23rd: leave it enabled. Finally, Imunify360 published its WAF rules on 21 October (ruleset 8.83), and version 8.88 has been stable since the 23rd: they block known vectors and do not replace the update.",{"type":36,"title":184,"body":185},"cPanel\u002FWHM's internal PHP and Roundcube: another PHP to update","MultiPHP and EasyApache govern the PHP of your sites. The cPanel and WHM interfaces and the Roundcube webmail run instead on an internal PHP shipped with cPanel itself, which choosing a version in MultiPHP Manager does not touch. On 21 October 2026, cPanel published a security update for this internal PHP, stating that it “affects PHP in cPanel interfaces, including Roundcube webmail”.\n\nIt delivers PHP 8.4.27 in cPanel & WHM 138.0.18, 136.0.50 and 134.0.66, and backported fixes for PHP 8.1.34 in version 110.0.153. These interfaces are open to your customers' logins, so often reachable from the internet: they are prime targets. Read your version with `\u002Fusr\u002Flocal\u002Fcpanel\u002Fcpanel -V` (or in the WHM banner) and compare it with these numbers. If your release series is not listed, do not assume it is fixed: check cPanel's release notes and move to a series that is.",{"type":49,"title":187,"body":188},"After patching, still turn off upload progress tracking","On 23 October 2026, PHP published a supplementary informational advisory: it recommends keeping `session.upload_progress.enabled=0` until the next regular bugfix release, to guard against a code-execution vector it considers unlikely. It targets applications that set `session.serialize_handler` to `php_binary` or `php_serialize`, then switch it back to `php` at runtime with `ini_set()` before `session_start()`. PHP announces a full advisory for CVE-2026-115560 with the next release. The setting only concerns the file upload progress bar.",{"type":36,"title":190,"body":191},"If you cannot update right away","The official PHP advisory suggests settings that **reduce** exposure without making the installation safe. They are there to buy you a few hours, not to replace the fix. They must be set in `php.ini`, in the PHP-FPM pool or in the web server configuration, never through `ini_set()` or a `.user.ini` file: those are read too late, after the request has already been parsed.\n\nAgainst CVE-2026-109619, disable upload progress tracking. On PHP 8.5, also disable fatal error backtraces:\n\n```ini\n; in the FPM pool, for example \u002Fetc\u002Fphp\u002F8.3\u002Ffpm\u002Fpool.d\u002Fwww.conf\nphp_admin_flag[session.upload_progress.enabled] = off\n; PHP 8.5 only:\nphp_admin_flag[fatal_error_backtraces] = off\n```\n\nAgainst CVE-2026-109618, the advisory recommends `memory_limit = -1` enforced through `php_admin_value`, so that no application can redefine it, together with a bounded request size (`post_max_size = 8M`, or 32M if you need file uploads). In return, memory has to be capped somewhere else, with a container or cgroup limit. Do not use `RLIMIT_AS` or `RLIMIT_DATA`: they are exactly what causes the vulnerable allocation failure.\n\nThen restart **all** PHP processes so that the settings take effect.",{"type":49,"title":193,"body":194},"Add a barrier in front of PHP","Cap the size of requests at the web server level, before they ever reach PHP: `client_max_body_size 8m;` in nginx, `LimitRequestBody 8388608` in Apache. If your site sits behind Cloudflare in proxied mode, WAF rules targeting the known PHP2Shell vectors have been rolled out to every account, the free plan included. These are safety nets only: nothing but the PHP update actually closes the flaw.",{"type":36,"title":196,"body":197},"Look for traces of exploitation","The published attempts leave characteristic traces behind: PHP processes that crash, bursts of out-of-memory errors and `multipart` uploads that are abnormally large. If your server was exposed before you updated it, take ten minutes to check.",{"type":101,"title":199,"steps":200},"Checks to run after applying the fix",[201,204,207,210],{"title":202,"body":203},"Look for killed PHP-FPM processes","```bash\nsudo grep -E 'exited on signal (11|6)' \u002Fvar\u002Flog\u002Fphp*-fpm.log | tail -20\n```\n\nA series of processes killed by signal 11 (SIGSEGV) since 21 October is a warning sign.",{"title":205,"body":206},"Look for memory limit overruns","```bash\nsudo grep -rh 'Allowed memory size' \u002Fvar\u002Flog\u002Fphp* \u002Fvar\u002Flog\u002Fnginx \u002Fvar\u002Flog\u002Fapache2 2>\u002Fdev\u002Fnull | tail -20\n```",{"title":208,"body":209},"Spot recently created PHP files","```bash\nsudo find \u002Fvar\u002Fwww \u002Fhome -name '*.php' -newermt '2026-10-20' -not -path '*\u002Fvendor\u002F*' -not -path '*\u002Fcache\u002F*' -ls\n```\n\nAn unknown file with a generic name, in an upload folder or in `\u002Ftmp`, should be examined before you delete anything.",{"title":211,"body":212},"When in doubt, treat the server as compromised","Isolate the machine, keep a copy of the logs, then rotate the database passwords, the API keys and the secrets stored in `.env` files: a memory leak may have exposed them without leaving any other trace behind.",{"type":40,"title":214,"items":215},"More signs to look for, according to primary sources",[216,217,218,219,220,221],"**Unusually large or deeply nested `multipart` requests** in the web server logs (watchTowr).","**PHP processes that crash or hit their memory limit** (watchTowr).","**Files written to web roots and outbound connections from PHP processes** that you cannot explain (watchTowr).","**New web shells, unexpected cron jobs and recently created accounts** tied to PHP processes (watchTowr).","**Preserve before you clean up**: PHP and web server logs, configuration snapshots and suspicious files, before changing anything (watchTowr). CISA also attaches forensic triage requirements to its KEV entry.","**No numeric indicator is published**: as of 27 October, neither watchTowr, nor PHP, nor the GitHub advisory for CVE-2026-109618 gives an IP address, a hash, a file name or a request signature. Be wary of unsourced indicator lists: the absence of an address in your logs proves nothing.",{"type":36,"title":223,"body":224},"On shared hosting","On shared hosting, you are not the one who updates PHP: the hosting provider maintains the versions on offer. Your part of the job is to check that your site uses a branch that still receives fixes. In cPanel, the version selection tool (**MultiPHP Manager**, or **Select PHP Version** on a CloudLinux server) shows the active version for each domain. If your site still runs on 7.4, 8.0 or 8.1, those branches no longer receive official PHP releases: switch to 8.3 or 8.4 after testing your site, following \u003Ca href=\"\u002Fen\u002Fblog\u002Fphp-82-end-of-life-planning-your-migration\">our PHP migration checklist\u003C\u002Fa>.",{"type":36,"title":226,"body":227},"The official documentation","The technical details and the workaround settings are published in \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php\">the PHP security advisory\u003C\u002Fa> and in the GitHub advisories \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-w8hw-w9fx-j79w\">GHSA-w8hw-w9fx-j79w\u003C\u002Fa> (CVE-2026-109618) and \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp\">GHSA-6wmf-4rv5-p3rp\u003C\u002Fa> (CVE-2026-109619). For distribution packages, see \u003Ca href=\"https:\u002F\u002Fubuntu.com\u002Fblog\u002Fphp2shell-vulnerability-fixes-available\">the Ubuntu announcement\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Falmalinux.org\u002Fblog\u002F2026-10-21-php2shell-cve-2026-109618-cve-2026-109619\u002F\">the AlmaLinux one\u003C\u002Fa>. For the follow-up: \u003Ca href=\"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog\">CISA's KEV catalog\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fdocs.cpanel.net\u002Fchangelogs\u002Feasyapache-4-change-log-25\u002F\">the EasyApache 4 changelog\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fdocs.cpanel.net\u002Frelease-notes\u002Frelease-notes\u002F\">the cPanel & WHM release notes\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fblog.cloudlinux.com\u002Fphp-cve-2026-109618-and-cve-2026-109619\">CloudLinux's bulletin\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fwatchtowr.com\u002Fintelligence\u002Fphp-cve-2026-109618-faq\u002F\">watchTowr's FAQ\u003C\u002Fa>.","Stay in control of your PHP versions","On a ServOrbit.com VPS, you have root access: you apply a PHP fix as soon as it is published, you choose the version used by each site and you restart your services whenever you decide to.","Explore our VPS plans","\u002Fvps-cloud",[233,250,271],{"id":234,"slug":235,"slugs":236,"title":240,"excerpt":241,"readTime":242,"views":243,"isPinned":19,"noindex":19,"publishedAt":244,"updatedAt":245,"category":246,"categories":247,"featuredImage":30,"bgImage":31,"posterImage":249,"relatedSolution":30},382,"vps-automatic-security-updates-debian-ubuntu",{"fr":237,"en":235,"ar":238,"es":239},"securite-vps-mises-a-jour-automatiques-debian-ubuntu","تحديثات-أمان-تلقائية-vps-debian-ubuntu","actualizaciones-seguridad-vps-debian-ubuntu","Automatic Security Updates on Debian\u002FUbuntu VPS","Configure unattended-upgrades on your Debian\u002FUbuntu VPS to automate security patches and reduce attack surface across your client fleet.",10,2,"2026-09-26T00:00:00+00:00","2026-11-09T20:55:15+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[248],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fsecurite-vps-mises-a-jour-automatiques-debian-ubuntu-poster.svg",{"id":251,"slug":252,"slugs":253,"title":257,"excerpt":258,"readTime":259,"views":260,"isPinned":19,"noindex":19,"publishedAt":261,"updatedAt":21,"category":262,"categories":268,"featuredImage":30,"bgImage":31,"posterImage":270,"relatedSolution":30},206,"php-82-end-of-life-planning-your-migration",{"fr":254,"en":252,"ar":255,"es":256},"php-82-fin-de-vie-checklist-migration","نهاية-دعم-php-82-دليل-الترحيل","php-82-fin-de-vida-planificar-la-migracion","PHP 8.2 end of life: your migration checklist","PHP 8.2 reaches EOL on December 31, 2026. Inventory your stack, compare PHP versions, and follow a step-by-step migration checklist to PHP 8.3 or 8.4.",11,7,"2026-08-01T00:00:00+00:00",{"id":263,"name":264,"slug":265,"color":266,"icon":267},4,"Development","developpement","bg-warning\u002F10 text-warning","dev",[269],{"id":263,"name":264,"slug":265,"color":266,"icon":267},"\u002Fblog\u002Fcovers\u002Fphp-82-fin-de-vie-checklist-migration-poster.svg",{"id":272,"slug":273,"slugs":274,"title":278,"excerpt":279,"readTime":23,"views":280,"isPinned":19,"noindex":19,"publishedAt":281,"updatedAt":282,"category":283,"categories":284,"featuredImage":30,"bgImage":31,"posterImage":286,"relatedSolution":287},373,"wordpress-cve-2026-87902-update-to-712-now",{"fr":275,"en":273,"ar":276,"es":277},"wordpress-cve-2026-87902-rce-mise-a-jour-7-1-2","ووردبريس-cve-2026-87902-ترقية-7-1-2","wordpress-cve-2026-87902-actualiza-a-712-urgente","WordPress CVE-2026-87902: Update to 7.1.2 Now","CVE-2026-87902 (CVSS 9.2) actively exploited since Sept. 22, 2026. Check your version, apply WordPress 7.1.2, and see why shared hosting extends exposure.",0,"2026-09-24T00:00:00+00:00","2026-10-26T18:53:20+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[285],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fwordpress-cve-2026-87902-rce-mise-a-jour-7-1-2-poster.svg",{"categorySlug":288,"appSlug":289},"cms-websites","wordpress",true,1794270467187]