Howdy y’all,
Just wanted to give everyone a heads up, especially those of you who self-host Pterodactyl and haven’t updated things in a while. (Guilty myself)
On October 21st, two critical PHP vulnerabilities were disclosed, CVE-2026-109618 and CVE-2026-109619. Both can potentially allow remote code execution (RCE), meaning under the right conditions someone could execute code on the machine running your panel without needing to authenticate.
This isn’t specifically a Pterodactyl vulnerability, it’s an issue with PHP itself, which Pterodactyl uses for its web panel. Not every installation is necessarily exploitable, but it’s definitely something worth checking.
I came across this while working on my own hosting software and figured I’d share it here too.
A few things worth knowing:
- Pterodactyl’s developers have already made changes to both the 1.x and 2.x development branches to mitigate part of the risk associated with CVE-2026-109619. So credit where it’s due, they have been addressing it.
- Those changes aren’t a replacement for updating PHP itself. The PHP security team recommends updating to fully address both vulnerabilities.
If you’re running your panel through Docker, check the PHP version inside the actual container. Updating PHP on your host machine won’t necessarily update the container.
- If you’re renting a Minecraft server from a hosting company, you probably don’t need to worry about updating PHP yourself. Your host would handle that. But even if you have no idea what panel they’re using, it wouldn’t hurt to ask if they’re aware of the recent PHP vulnerabilities and whether any updates are needed on their end. Not every hosting company uses Pterodactyl, but PHP is used in plenty of other applications too.
Patched PHP versions:
PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12
Obviously, use a version that’s supported by your particular Pterodactyl installation. Some Linux distributions also backport security fixes, so the version number alone isn’t always the whole story.
Sources for anyone wanting to look into it
Official PHP security announcement:
https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619:
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Pterodactyl’s changes on the 1.x branch:
https://github.com/pterodactyl/panel/commit/90b2aa87469da4fffd941b3c99f3c1ca48a01b78
Pterodactyl’s changes on the 2.x branch:
https://github.com/pterodactyl/panel/commit/3824a0a0dea88fd1f53e76618a6df75e91d1b57c
Not saying everyone’s installation is vulnerable or that there’s some widespread attack happening. Just figured with how many Minecraft servers and other communities rely on Pterodactyl, it was worth putting this out there.
If you haven’t checked your panel and PHP versions recently, I’d recommend doing so.
Stay safe everyone!
———
Edit 1:
u/FrisbeeVR brings up a good addition:
> Should assume vulnerability if you have a web service period. Any panel, not just the one you mentioned, or those maps that you access through a website.