Direct answer

If you run Pterodactyl Panel 1.x, review the 1.15.2 security release promptly. The maintainers identify PHP2Shell issues CVE-2026-109618 and CVE-2026-109619. The update changes its Docker runtime to PHP 8.3.36 and disables session.upload_progress in PHP-FPM. For a non-Docker installation, follow the release’s PHP package update requirements.

Who should take action

  • Check the Panel version and whether PHP is delivered by a Docker image or installed on the host. Wings and a Minecraft server JAR are different components; changing the Minecraft JAR does not patch the Panel.
  • If you use a third-party Pterodactyl fork or managed service, ask the provider whether this specific security fix is included. Do not assume a matching-looking version string is equivalent.
  • A security release is not proof that a particular installation was compromised. Treat suspicious activity as a separate investigation.

Before updating

  1. Schedule a maintenance window and identify how the Panel and PHP were installed.
  2. Take a restorable database backup, preserve the Panel .env securely, and record the current Panel/Wings versions. Keep backup material off the public webroot.
  3. Review official Pterodactyl 1.x update instructions and the 1.15.2 release notes. They describe the supported 1.x path; do not substitute the 2.0 beta procedure.
  4. Update the Panel and appropriate PHP packages/image together as the maintainers instruct; confirm system and web-server PHP runtimes are actually using the patched versions.

Verification after maintenance

  • Check Panel login, API, queue worker, file manager and at least one server start/stop action.
  • Check error logs for PHP-FPM issues, permissions and migration failures without posting session tokens or credentials.
  • Verify the installed version from the application, not just an archive filename.
  • If something fails, return the Panel, database and runtime to a compatible pre-update state using the tested recovery plan; do not restore only code while leaving an incompatible migrated database.

What not to do

Do not copy a random CVE exploit, disable authentication, or downgrade to an unpatched build to make the Panel work. Do not run unreviewed migration commands against your only database without a backup. The security bulletin does not establish that every Minecraft server hosted by Pterodactyl is vulnerable.

Official references

Official sources for version-sensitive details. Check the newest release notes before changing a production server.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000