Overview
JetApps has released security updates for the PHP bundled with JetBackup 5 and JetBackup MC. These updates address CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can, under certain conditions, allow unauthenticated remote code execution.
For technical details, see PHP's security advisory
Updated versions
- JetBackup 5 on CentOS 7/CloudLinux 7: 5.3.12.2, bundled with PHP 8.1.34.0
- JetBackup 5, supported operating systems, ALPHA and EDGE tiers: 5.4.2.5, bundled with PHP 8.3.36.0
- JetBackup 5, supported operating systems, RELEASE and RC tiers: 5.4.1.5, bundled with PHP 8.3.36.0
- JetBackup MC on all release tiers: 1.1.14, bundled with PHP 8.3.36.0
*List of supported operating systems
How do I get the update?
The updates are delivered automatically. You do not need to change your release tier or download a package manually.
To apply available updates immediately, run the following command as root on your server, regardless of your control panel:
jetapps -aHow do I confirm the update is installed?
Run the following command as root:
jetapps --list-installedFind the JetBackup 5 or JetBackup MC package in the output and compare its version with the applicable version listed above. The package may show an additional build number after the product version.
What if my server has not updated?
Run jetapps -a and check the installed version again. If the applicable version still does not appear, please open a support ticket and include:
- Your operating system and version
- Your JetBackup product and release tier
- The output of
jetapps --list-installed - Any error shown when running
jetapps -a
Does this update cover PHP used by my websites?
This update covers the PHP bundled with JetBackup products. PHP installations used by websites or other applications must be checked and updated separately through their respective package provider or control panel.
Troubleshooting:
The expected version does not appear after updating
If jetapps -a reports that packages are up to date but jetapps --list-installed still shows an older JetBackup or JetBackup MC version, update the product package directly using your intended update tier.
Run the following commands as root, replacing PACKAGE_NAME with the package name shown by jetapps --list-installed and YOUR_TIER with the tier your server is meant to use:
jetapps --chtier PACKAGE_NAME YOUR_TIER
jetapps -u PACKAGE_NAME
jetapps --list-installedCompare the installed version with the applicable version listed above. A number after the version, such as the -2 in 5.3.12.1-2, is a package build number; it does not mean the product has been updated to 5.3.12.2.
Keep your intended update tier. If you are unsure of the package name or tier, or the expected version still does not appear, contact JetBackup Support with your operating system, product, intended tier, the output of jetapps --list-installed, and any error from the update command.
