Commit

Two security waves in about a day, three hotfixes shipped to the servers FlashPanel manages. PHP (CVE-2026-109618, CVE-2026-109619, unauthenticated RCE): - Before the 14:00 UTC release: the recommended php.ini mitigation on every PHP-FPM and lsphp install. - Within the hour after release: upgrade to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 from packages.sury.org, moving servers still on the old ondrej/php PPA over first. Your php.ini and FPM pools stay as they are. - Next morning LiteSpeed published patched lsphp, so OpenLiteSpeed servers got the same upgrade. Node.js (October security release, 4 highs including a Brotli out-of-bounds write, CVE-2026-111497): - Upgrade to 22.23.4 / 24.22.1 / 26.12.1, never across majors, and no auto-restart of your app. No SSH needed: open your server list and the hotfixes run. A server only counts as patched once the fixed version is actually installed. Servers still waiting on packages (some ARM builds) get retried later instead of being marked done. https://flashpanel.io/dashboard/servers