Critical PHP Security Release - CVE-2026-109618 and CVE-2026-109619

Situation

Critical security vulnerabilities were found in PHP, and have been assigned CVE-2026-109618 and CVE-2026-109619. 

Affected product version

Impact

All shipped PHP versions are suspected to be vulnerable at this time. Successful exploitation of this vulnerability can allow remote code execution (RCE) on affected PHP versions.

Call to action

At this time we have released updates to PHP versions ea-php74 and above, to address vulnerabilities reported in CVE-2026-109618 and CVE-2026-109619.

Update to the latest patched version: How do I update cPanel/WHM?

The following command can be run to update ea-php versions specifically:

# /scripts/rpmup

To confirm if your installed version of PHP is updated, use the following command and replace "php81" with the version you wish to check:

# rpm -q --changelog ea-php81-php-cli | grep -m1 CVE-2026-109618

Note: For PHP versions older than 7.4, TuxCare Extended Lifecycle Support (ELS) for PHP should be used