{"count":1,"next_page":null,"page":1,"page_count":1,"per_page":30,"previous_page":null,"articles":[{"id":44397389677335,"url":"https://cpanel.zendesk.com/api/v2/help_center/en-us/articles/44397389677335.json","html_url":"https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619","author_id":399370399934,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":6,"vote_count":6,"upvote_count":6,"downvote_count":0,"section_id":360007088193,"created_at":"2026-10-20T20:55:37Z","updated_at":"2026-10-22T17:43:29Z","name":"Critical PHP Security Release - CVE-2026-109618 and CVE-2026-109619","title":"Critical PHP Security Release - CVE-2026-109618 and CVE-2026-109619","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-10-22T09:59:05Z","user_segment_id":null,"permission_group_id":12377268923927,"content_tag_ids":[],"label_names":["alert_article_for_request","kb: security"],"body":"

Situation

Critical security vulnerabilities were found in PHP, and have been assigned CVE-2026-109618 and CVE-2026-109619. 

For more information, you can find the official announcement here:

PHP News Archive | 21 Oct 2026 

 

Affected product version

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ProductAffected versionsPatched versions
cPanel & WHMAll supported versions
    \n
  • 11.110.0.153
    • \n
  • 11.134.0.66
    • \n
  • 11.136.0.50
    • \n
  • 11.138.0.18
    • \n
  • WP Squared: 11.138.1.17
    • \n
cPanel EasyApache4PHP 5.0 and later
    \n
  • ea-php74: 7.4.33-19
    • \n
  • ea-php80: 8.0.30-12
    • \n
  • ea-php81: 8.1.34-5
    • \n
  • ea-php82: 8.2.35
    • \n
  • ea-php83: 8.3.36
    • \n
  • ea-php84: 8.4.27
    • \n
  • ea-php85: 8.5.12
    • \n
CloudLinux EasyApache4PHP 5.0 and later
    \n
  • ea-php52: 5.2.17-27
    • \n
  • ea-php53: 5.3.29-29
    • \n
  • ea-php54: 5.4.45-82
    • \n
  • ea-php55: 5.5.38-64
    • \n
  • ea-php56: 5.6.40-25
    • \n
  • ea-php70: 7.0.33-29
    • \n
  • ea-php71: 7.1.33-20
    • \n
  • ea-php72: 7.2.34-12
    • \n
  • ea-php73: 7.3.33-15
    • \n
  • ea-php74: 7.4.33-18
    • \n
  • ea-php80: 8.0.30-11
    • \n
  • ea-php81: 8.1.34-4
    • \n
  • ea-php82: 8.2.34-2
    • \n
  • ea-php83: 8.3.35-2
    • \n
  • ea-php84: 8.4.26-2
    • \n
  • ea-php85: 8.5.11-2
    • \n

Note: For information regarding updates for CloudLinux provided PHP packages, you can follow their status page here:

\n

CloudLinux Incident Report

\n

 

\n

Impact

All shipped PHP versions are suspected to be vulnerable at this time. Successful exploitation of this vulnerability can allow remote code execution (RCE) on affected PHP versions.

 

Call to action

At this time we have released updates to PHP versions ea-php74 and above, to address vulnerabilities reported in CVE-2026-109618 and CVE-2026-109619.

Update to the latest patched version:

How do I update cPanel/WHM?

The following commands can be run to update ea-php versions specifically.

    \n
  1. \n

    Ensure that the server has the latest update data from the repositories:

    \n

    CentOS/RHEL:

    \n

    #  yum clean all && yum makecache

    \n

    Ubuntu:

    \n

    # apt clean && apt update

    \n
    2. \n
  2. \n

    Then, perform an update:

    \n

    #  /scripts/update-packages

    \n
    3. \n

To confirm if your installed version of PHP is updated, use the following command and replace \"php81\" with the version you wish to check:

# rpm -q --changelog ea-php81-php-cli | grep -m1 CVE-2026-109618

For Ubuntu servers, you will need to use zgrep:

# zgrep -E 'CVE-2026-109618' /usr/share/doc/ea-php81-php-cli/changelog.Debian.gz

Note: For PHP versions older than 7.4, TuxCare Extended Lifecycle Support (ELS) for PHP should be used:

TuxCare Extended Lifecycle Support (ELS) for PHP

","user_segment_ids":[]}],"sort_by":"position","sort_order":"asc"}