Upcoming Critical PHP Security Release

Rene Valladares

• October 21, 2026 02:20

Php just announced a upcoming security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

How can we update the php versions on our servers? it's a general update or easyphp? Do we have to wait for cpanel patches?

• 

  Gareth-AWD

  • October 21, 2026 22:05
  • Edited

  To update, run:
  yum clean all
  yum update "ea-php*"
  Then restart Apache and PHP-FPM:
  /scripts/restartsrv_httpd
  /scripts/restartsrv_apache_php_fpm
  
  To confirm a version is fixed, check its PHP package, for example:
  rpm -q ea-php71-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'

  It depends which version of CloudLinux you're using. Some will be applied to ea-php71-php-cli for example.  However, I've found if you're using TuxCare ELS instead, the fixed versions are actually only in the alt-php and not the ea-php71-php-cli.

  Well that's what it seems to be when doing the above.  Somebody may need to confirm.

  Cpanel need to identify in EasyApache if the version is a patched version IMO.

  0
• 

  David

  • October 21, 2026 22:06

  They finally did a correction, turns out none of the alt packages for CloudLinux 7, 8 and 9 are available yet. see: https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619

  1
• 

  ElGato

  • October 21, 2026 22:26

  CloudLinux's work on patching the PHP versions is turning out to be a total disaster.

  More than 8 hours later, we're still waiting.

  I don't understand any of this.

  0
• 

  David

  • October 21, 2026 22:42

  wow - they now need us to add a repository! crazy.

  0
• 

  matt1206

  • October 21, 2026 22:47

  They haven't increased the version either

  [23:44][root@XXX ~]# rpm -q --changelog alt-php82-common | grep -E 'CVE-2026-(109618|109619)'
  - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator,
  [23:44][root@XXX ~]# rpm -qa | grep alt-php82-common
  alt-php82-common-8.2.34-7.el9.x86_64

  0
• 

  Metro2

  • October 21, 2026 23:01

  And by CloudLinux backporting the fix and not updating the PHP version numbers, even though I've installed the patched versions, I now have customers asking why it still says "8.4.26" in things like WordPress > Tools info, worried that it's not 8.4.27 and not truly patched. SMH
  
  Patched ea-php packages have been released to the stable repository for all versions from ea-php52 through ea-php85. Fixed versions (elX = el7, el8, el9 or el10):
  - ea-php52: 5.2.17-27.elX.cloudlinux.67
  - ea-php53: 5.3.29-29.elX.cloudlinux.69
  - ea-php54: 5.4.45-82.elX.cloudlinux.9
  - ea-php55: 5.5.38-64.elX.cloudlinux.10
  - ea-php56: 5.6.40-25.elX.cloudlinux.18
  - ea-php70: 7.0.33-29.elX.cloudlinux.17
  - ea-php71: 7.1.33-20.elX.cloudlinux.17
  - ea-php72: 7.2.34-12.elX.cloudlinux.18
  - ea-php73: 7.3.33-15.elX.cloudlinux.18
  - ea-php74: 7.4.33-18.elX.cloudlinux.13
  - ea-php80: 8.0.30-11.elX.cloudlinux.1
  - ea-php81: 8.1.34-4.elX.cloudlinux.1
  - ea-php82: 8.2.34-2.elX.cloudlinux.1
  - ea-php83: 8.3.35-2.elX.cloudlinux.2
  - ea-php84: 8.4.26-2.elX.cloudlinux.1
  - ea-php85: 8.5.11-2.elX.cloudlinux.1

  0
• 

  cPRex Jurassic Moderator

  • October 21, 2026 23:13

  I wish I could do more for you guys with the CloudLinux packages!  The only real thing I can recommend is to watch their status page for updates.

  0
• 

  Metro2

  • October 21, 2026 23:35

  Thanks cPRex . It looks like CL has decided to call it a day and just keep it backported to 8.4.26 and 8.3.35 , which between the delayed EA-PHP and customers all checking eagerly all day has create chaos. 

  /me puts auto-responder in support email - "Yes, we promise that we've actually patched, even though your script is showing you the version number that your Instagram is scaring you with".

   

  0

Please sign in to leave a comment.