What DirectAdmin (CustomBuild) says
DirectAdmin staff (user fln) posted in the 'Critical PHP updates' forum thread that new builds on the current and stable channels bump PHP 8.5, 8.4, 8.3, 8.2 and add patches for 8.1, 8.0 and 7.4. PHP 7.3 to 5.6 have no patch yet. A build problem on some systems with PHP 8.1 was reported by staff. The forum page shows only relative timestamps ('Today'), so no calendar date is verified; the first post was made the day before the 2026-10-21 release.
They bump PHP 8.5, 8.4, 8.3, 8.2 to latest version, and adds patches for PHP 8.1, PHP 8.0 and PHP 7.4.PHP versions 7.3 - 5.6 does not yet have a patchCheck the PHP version
'da build versions' shows the software CustomBuild has installed (per CustomBuild overview docs). Staff post: if custombuild/patches/php-7.4/143-php-7.4-cve-2026-109618.patch exists and CustomBuild offers no 7.4 update, the install is current.
Update PHP
Staff: run 'da update', then 'da build php'. DirectAdmin updates itself automatically but the PHP rebuild must be started by hand unless the CustomBuild cron option is enabled. Docs: PHP release per slot via 'da build set php1_release 8.1' etc., then 'da build php' and 'da build rewrite_confs'. An asterisk next to a version means same release number with new patches applied (staff).