PHP: CVE-2026-109618 & CVE-2026-109619 Fixed Across All Our Hosting Environments

We have installed the security updates for CVE-2026-109618 and CVE-2026-109619 across all CloudLinux alt-PHP versions we use. The fixes for PHP 5.2 through PHP 8.5 are live on our hosting systems.

What the security updates fix

Both critical vulnerabilities affect PHP itself, which powers many websites. Under certain conditions, they can allow unauthorised parties to execute code on an affected server without logging in. The security updates fix these specific vulnerabilities. PHP security advisory

Security fixes for older PHP versions

We use CloudLinux alt-PHP. CloudLinux also applies the security fixes to older PHP versions. These updates, known as backports, can retain the displayed base PHP version. The updated package release and the fixes documented in the vendor’s changelog are what matters. An older version number alone therefore does not show whether these vulnerabilities remain present. CloudLinux status report

On 21 October 2026, the PHP project released the regular security versions PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. These version numbers should be distinguished from our updated CloudLinux alt-PHP packages. A backport does not change the PHP project’s regular support status for an older PHP branch. PHP releases and support information

No action is required for these security updates

All CloudLinux alt-PHP versions we use, from PHP 5.2 through PHP 8.5, are already patched and live. You do not need to change your PHP version for these fixes.

If you wish to change your PHP version independently of these updates, you can do so in cPanel under Select PHP Version. You can also set a different PHP version for individual directories.