PHP critical vulnerabilities (October 2026)
PHP 8.3.36 fixes two critical vulnerabilities in PHP itself that can allow unauthenticated remote code execution. VirtFusion runs on its own PHP packages, so every control server and every hypervisor is affected until it is running PHP 8.3.36. The updated packages are available now for every supported system, on x86_64 and AArch64 (ARM). See Package status below, then update with the steps in Remediation.
Summary
| Field | Detail |
|---|---|
| Component | PHP core, as shipped in VirtFusion's vf-php8 and vf-system-php8 packages |
| Severity | Critical (CVSS v4.0 9.2 each) |
| CVE | CVE-2026-109618, RCE via OOM corruption (GHSA-w8hw-w9fx-j79w) CVE-2026-109619, RCE via stale global state (GHSA-6wmf-4rv5-p3rp) |
| Details | Published by the PHP project on 21 October 2026 |
| Fixed in | PHP 8.3.36 |
| Official mitigation | Updating PHP. The PHP project lists partial configuration mitigations, but none is complete. |
| VirtFusion packages | vf-php8 and vf-system-php8 8.3.36-1, with vf-nginx 1.30.6-1 in the same update |
| Where it applies | Control servers (vf-php8) and hypervisors (vf-php8 and vf-system-php8), on every VirtFusion version |
The same update moves vf-nginx to nginx 1.30.6, which fixes five vulnerabilities rated medium by nginx. See the nginx security advisories.
Am I affected?
Yes, unless the server is already running VirtFusion's PHP 8.3.36 packages. VirtFusion does not use the operating system's PHP, so updating the distribution's own php packages does not fix this. Check the version VirtFusion runs:
/opt/virtfusion/php8/bin/php -v | head -n 1
# On a hypervisor, also:
/opt/virtfusion/system/php8/bin/php -v | head -n 1
Any version below 8.3.36 is affected.
Package status
These are the packages in the update. All of them are in the VirtFusion repository; install them with the steps in Remediation.
| Package | Version | Systems | Arch | Distribution | Status |
|---|---|---|---|---|---|
| vf-php8 | 8.3.36-1 | Control, Hypervisor | x86_64 | Debian 13, Debian 12, Debian 11, Ubuntu 24.04, Ubuntu 22.04, RHEL 10, RHEL 9, RHEL 8 | ✅ Available |
| vf-system-php8 | 8.3.36-1 | Hypervisor | x86_64 | Debian 13, Debian 12, Debian 11, Ubuntu 24.04, Ubuntu 22.04, RHEL 10, RHEL 9, RHEL 8 | ✅ Available |
| vf-nginx | 1.30.6-1 | Control, Hypervisor | x86_64 | Debian 13, Debian 12, Debian 11, Ubuntu 24.04, Ubuntu 22.04, RHEL 10, RHEL 9, RHEL 8 | ✅ Available |
| vf-php8 | 8.3.36-1 | Hypervisor | AArch64 | Debian 13, Debian 12, RHEL 10 | ✅ Available |
| vf-system-php8 | 8.3.36-1 | Hypervisor | AArch64 | Debian 13, Debian 12, RHEL 10 | ✅ Available |
| vf-nginx | 1.30.6-1 | Control, Hypervisor | AArch64 | Debian 13, Debian 12, RHEL 10 | ✅ Available |
RHEL means RHEL itself and the distributions built from it, such as AlmaLinux and Rocky Linux. A control server needs vf-php8 and vf-nginx; a hypervisor needs all three.
Remediation
Once the packages for your distribution show ✅ Available in Package status, update the control server and every hypervisor.
- Put VirtFusion into Maintenance Mode, so that no tasks are running while the services restart.
- Run the commands for your base distribution as root in SSH, on the control server and on every hypervisor. They install the updated packages and restart the services that use them.
- Debian/Ubuntu
- RHEL
For Debian 11, 12 and 13, and Ubuntu 22.04 and 24.04, on x86_64 and AArch64.
Control
apt-get update -y && apt-get install --only-upgrade vf-nginx vf-php8 -y
vfcli-ctrl app:restart --services=queue,fpm,web
Hypervisor
apt-get update -y && apt-get install --only-upgrade vf-nginx vf-php8 vf-system-php8 -y
vfcli-hv app:restart --services=queue,system-fpm,fpm,web
For RHEL 8, 9 and 10, and the distributions built from them, such as AlmaLinux and Rocky Linux, on x86_64 and AArch64.
Control
dnf makecache -y && dnf update vf-nginx vf-php8 -y
vfcli-ctrl app:restart --services=queue,fpm,web
Hypervisor
dnf makecache -y && dnf update vf-nginx vf-php8 vf-system-php8 -y
vfcli-hv app:restart --services=queue,system-fpm,fpm,web
- Confirm PHP reports the new version:
/opt/virtfusion/php8/bin/php -v | head -n 1
# On a hypervisor, also:
/opt/virtfusion/system/php8/bin/php -v | head -n 1
Both should report PHP 8.3.36.
- Take VirtFusion out of Maintenance Mode once every system has been updated.
Timeline
| Date | Event |
|---|---|
| 2026-10-14 | nginx 1.30.6 released, fixing five vulnerabilities |
| 2026-10-20 | The PHP project announces a security release fixing two critical vulnerabilities (CVSS 9.2), due 21 October at 14:00 UTC |
| 2026-10-21 | PHP 8.3.36 released, with advisories for CVE-2026-109618 and CVE-2026-109619 |
| 2026-10-21 | VirtFusion 8.3.36 packages published for x86_64 |
| 2026-10-21 | VirtFusion 8.3.36 packages published for AArch64 Debian 12 and 13 |
| 2026-10-21 | VirtFusion 8.3.36 packages published for AArch64 RHEL 10; every package in the update is available |