On 21 October 2026, the PHP project released fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. Active exploitation has been reported.

We have no access to your VPS, VDS or Dedicated Server, so we cannot apply the update for you. Please install it immediately, as soon as patched packages are available for your system.

The vulnerabilities

• CVE-2026-109618: remote code execution via out-of-memory corruption
• CVE-2026-109619: remote code execution via stale global state

Both are rated 9.2 (critical) on the CVSS v4.0 scale. All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php. For full details, see the official PHP security advisory.

Fixed PHP versions

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35 (end of life on 31 December 2026, so please plan an upgrade)

PHP 8.1 and older no longer receive updates from the PHP project. If you run one of these versions, please upgrade to a supported version or check for backported fixes. Minimal source-code backports for PHP 7.4, 8.0 and 8.1 exist, but only for building from source.

What you should do

1. Create a snapshot or backup before updating.
2. Update PHP via your distribution’s package manager or your control panel as soon as the patched version is available.
3. Restart PHP-FPM, Apache or your web server so that all workers load the new version. Without a restart, the old code keeps running.
4. Verify the version actually in use, for example with php -v and with a phpinfo page for your web server. Check every PHP version installed on the server.
5. If you cannot update immediately, apply the interim measures from the official PHP security advisory. They only reduce exposure and do not make the installation safe. Updating is the only complete fix.

Where to find patches for your panel

• cPanel/WHM and EasyApache 4: Updates for EasyApache 4 are already available. Run the cPanel update now (via WHM or /scripts/upcp), then restart PHP-FPM/Apache and verify the PHP versions in use. Release notes and announcements are at docs.cpanel.net.
• Plesk: Updates for Plesk Obsidian are already available. Please update via the Plesk panel.
• CloudLinux (Alt-PHP): Follow the CloudLinux status page and the CloudLinux blog. CloudLinux also offers extended support for PHP versions that are no longer maintained.
• Linux distributions: Check the security advisories of your distribution (Debian, Ubuntu, AlmaLinux, Rocky Linux, RHEL and others).
• Third-party repositories: The volunteer-maintained rpms.remirepo.net does not provide updates on the release day. The PHP project recommends switching to distribution packages or building from source.

Best practices

• Enable automatic security updates where possible, and check your panel’s update settings.
• Remove PHP versions and applications you no longer use.
• Keep your CMS, plugins and themes up to date.
• Use a web application firewall and limit access to administrative interfaces.
• Check for signs of compromise: unknown files in web directories, new cron jobs, unusual processes, or spikes in load and outgoing traffic.