URGENT SECURITY ADVISORY: Two Critical PHP Vulnerabilities — Update Your Server Now

Published: October 22, 2026 Severity: Critical (CVSS 9.2/10) Identifiers: CVE-2026-109618 and CVE-2026-109619 All customers operating PHP-based websites or applications should review this security advisory immediately. Two critical vulnerabilities disclosed on October 21, 2026 may allow unauthenticated attackers to execute malicious code on affected servers under certain conditions. Official security patches are now available. Apply the updates without delay. Do not rely solely on firewall protection or PHP configuration changes.

Who may be affected?

• Owners of VPS/VDS, cloud, and dedicated servers running WordPress, Laravel, WooCommerce, or custom PHP applications.
• Administrators using cPanel/WHM, CloudLinux, Plesk, Apache, Nginx, LiteSpeed, or PHP-FPM.
• Servers using legacy PHP releases or any PHP installation that has not received the security fix.

These vulnerabilities affect the PHP runtime itself rather than a specific application. Updating WordPress, Laravel, or other applications is important, but does not replace installing the PHP security patches.

Fixed PHP versions

Important: CloudLinux, cPanel, and some Linux distributions may backport the security fixes into packages retaining older PHP version numbers. Therefore, php -v alone does not confirm whether your installation is patched. PHP 8.1 and older versions do not receive new upstream PHP releases. Obtain security-supported vendor packages or migrate to a supported PHP branch.

What server owners must do

1. Back up your server and identify PHP installations

Before updating, create a current backup or snapshot of application files, databases, and configuration. Schedule a maintenance window for production workloads. Identify every PHP version serving websites or applications. Updating only the default PHP installation may leave other instances vulnerable.

2. Install the appropriate security updates

cPanel / WHM servers Update both cPanel & WHM and EasyApache 4 PHP packages. For servers with SSH administration access, cPanel documents the following package update command:

/scripts/rpmup

Also update the panel itself through WHM > Upgrade to Latest Version, because cPanel's internal PHP runtime was affected. Panel updates and website PHP updates are separate operations. CloudLinux 8, 9, and 10 servers With root privileges, update the installed PHP package families:

dnf clean all
dnf upgrade 'ea-php*'
dnf upgrade 'alt-php*'

Use yum instead of dnf on CloudLinux 7. Skip the ALT-PHP step if it is not installed. Patched CloudLinux packages are available in the stable repositories. Some patched packages retain older upstream PHP version numbers, so verify the fix through the package changelog. Ubuntu / Debian servers Check your distribution's security advisory and update PHP using an official or trusted package repository:

sudo apt update
sudo apt list --upgradable
sudo apt upgrade

AlmaLinux / Rocky Linux / RHEL servers Use the appropriate dnf package updates. If PHP was installed from a third-party repository, check that provider's security advisory. Review the proposed package changes before proceeding, as operating system upgrades may affect additional components. Plesk, Docker, and Windows servers Update PHP through Plesk's PHP update mechanism, a patched container image, or the official Windows PHP distribution. For Docker applications, rebuild and redeploy using the fixed PHP base image. On Windows/IIS servers, restart or recycle the affected PHP/FastCGI processes.

3. Restart PHP workers and verify the patch

Following installation, ensure PHP-FPM, Apache, LiteSpeed/LSAPI, or other PHP workers load the patched binaries. Perform the required service restart or reload during a controlled maintenance window. Brief interruptions may occur. Example CloudLinux/cPanel verification commands:

rpm -q ea-php83-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'
rpm -q alt-php82-common --changelog | grep -E 'CVE-2026-(109618|109619)'

Run these commands only if the corresponding packages are installed. No output does not conclusively mean the installation remains vulnerable. Compare installed package revisions with the vendor's security advisory. The CLI PHP version may differ from the PHP runtime handling web traffic. Verify the actual HTTP environment as well.

4. Update Imunify360 WAF rules

If Imunify360 is installed, confirm that the WAF ruleset is at version 8.85. If older rules are installed, use the vendor-documented command:

imunify360-agent update --force modsec-rules

Important for LiteSpeed: Certain exploit patterns were only logged under ruleset 8.83. Additional LiteSpeed blocking rules arrived in 8.84, with further protection in 8.85. WAF rules are temporary defense mechanisms and do not replace PHP security patches. ImunifyAV and ImunifyAV+ alone do not provide these WAF protections.

5. If you cannot update immediately

As a partial temporary mitigation, disable this setting in the effective server-level PHP configuration:

session.upload_progress.enabled = Off

Restart PHP workers after applying the change. This does not fully mitigate either vulnerability. It only limits certain attack paths and may affect some custom upload-progress indicators. Apply the official patches as soon as possible.

Post-update security checklist

• Verify that websites, login sessions, and file uploads function correctly.
• Confirm that patched PHP packages are installed and older worker processes have been replaced.
• Review server logs, WAF events, unexpected file changes, and indications of unauthorized access.
• If compromise indicators are found, initiate incident response rather than relying on patching alone.

Managed hosting vs. self-managed VPS/VDS

Shared hosting and fully managed hosting customers should contact their provider to confirm the patch status. Self-managed VPS/VDS and dedicated server customers are generally responsible for updating the operating system, PHP packages, and hosted applications, depending on the terms of their management agreement. Our technical team is available for assistance upon request. This advisory does not indicate that any particular customer server has been compromised. Its purpose is to help customers promptly address confirmed critical security vulnerabilities.

Official references

• PHP security announcement
• cPanel critical PHP security advisory
• CloudLinux PHP and Imunify360 advisory
• CloudLinux security update status

Last updated: October 22, 2026. Always verify the latest official vendor guidance before applying updates.