Two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed. Both vulnerabilities have been rated CVSS 4.0: 9.2 (Critical), and successful exploitation may allow Remote Code Execution (RCE) on affected PHP installations.

Affected Software: cPanel & WHM EasyApache 4 PHP packages.

The security updates cover PHP 7.4 through PHP 8.5, including backported fixes for older supported PHP branches. cPanel has also released corresponding updates for supported cPanel & WHM versions.

Recommended Actions:

  • Update cPanel & WHM and all affected EasyApache 4 PHP packages.

  • Verify the installed package versions and changelogs.

  • Check every PHP version used by hosted websites, not only the default version.

  • Review your server's update status before considering the system fully patched.

Update EasyApache 4 packages:

/scripts/rpmup

Verify the PHP security changelogs:

for v in 74 {80..85}; do
    echo "=== ea-php${v}-php-cli ==="
    rpm -q --changelog "ea-php${v}-php-cli" |
        grep -m1 -E 'CVE-2026-109618|CVE-2026-109619' ||
        echo "CVE not found"
done

A matching changelog entry indicates that the package documents the fix. For stronger verification, confirm that the installed RPM versions meet the patched versions listed in the official advisory.

Important: Do not overlook legacy PHP versions. cPanel recommends TuxCare Extended Lifecycle Support (ELS) for PHP versions older than 7.4.

Official advisory:
https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619



Thursday, October 22, 2026

« Back