Skip to main content

Critical PHP Security Release - CVE-2026-109618 and CVE-2026-109619

Christopher Barnett
  • Updated

Situation

Critical security vulnerabilities were found in PHP, and have been assigned CVE-2026-109618 and CVE-2026-109619. 

For more information, you can find the official announcement here:

PHP News Archive | 21 Oct 2026 

 

Affected product version

Product Affected versions Patched versions
cPanel & WHM All supported versions
  • 11.110.0.153
  • 11.134.0.66
  • 11.136.0.50
  • 11.138.0.18
  • WP Squared: 11.138.1.17
cPanel EasyApache4 PHP 5.0 and later
  • ea-php74: 7.4.33-19
  • ea-php80: 8.0.30-12
  • ea-php81: 8.1.34-5
  • ea-php82: 8.2.35
  • ea-php83: 8.3.36
  • ea-php84: 8.4.27
  • ea-php85: 8.5.12
CloudLinux EasyApache4 PHP 5.0 and later
  • ea-php52: 5.2.17-27
  • ea-php53: 5.3.29-29
  • ea-php54: 5.4.45-82
  • ea-php55: 5.5.38-64
  • ea-php56: 5.6.40-25
  • ea-php70: 7.0.33-29
  • ea-php71: 7.1.33-20
  • ea-php72: 7.2.34-12
  • ea-php73: 7.3.33-15
  • ea-php74: 7.4.33-18
  • ea-php80: 8.0.30-11
  • ea-php81: 8.1.34-4
  • ea-php82: 8.2.34-2
  • ea-php83: 8.3.35-2
  • ea-php84: 8.4.26-2
  • ea-php85: 8.5.11-2

Note: For information regarding updates for CloudLinux provided PHP packages, you can follow their status page here:

CloudLinux Incident Report

 

Impact

All shipped PHP versions are suspected to be vulnerable at this time. Successful exploitation of this vulnerability can allow remote code execution (RCE) on affected PHP versions.

 

Call to action

At this time we have released updates to PHP versions ea-php74 and above, to address vulnerabilities reported in CVE-2026-109618 and CVE-2026-109619.

Update to the latest patched version:

How do I update cPanel/WHM?

The following commands can be run to update ea-php versions specifically.

  1. Ensure that the server has the latest update data from the repositories:

    #  yum clean all && yum makecache

  2. Then, perform an update:

    #  /scripts/rpmup

To confirm if your installed version of PHP is updated, use the following command and replace "php81" with the version you wish to check:

# rpm -q --changelog ea-php81-php-cli | grep -m1 CVE-2026-109618

Note: For PHP versions older than 7.4, TuxCare Extended Lifecycle Support (ELS) for PHP should be used:

TuxCare Extended Lifecycle Support (ELS) for PHP

Related articles

Comments

0 comments

Article is closed for comments.

%