Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619

Update:

• All servers and all PHP versions are patched. there is no action required from users.
• The security issue affected all PHP families including PHP 8.3x, 8.4x and 8.5x.
• We use PHP 8.3 by default in all servers. You can choose another version from your cPanel ❯ Select PHP version
• Upgrading between major PHP versions (for example, from PHP 8.3 to 8.4) is not mandatory and does not automatically make your website more secure. While keeping PHP up to date is generally advisable, in this case it does not provide any significant advantage. It's important to ensure that your installed software is fully compatible with the latest PHP version before upgrading.

For advanced users and who uses AI 🤷, here is the proof of the fix (just a sample for the native PHP 8.3, all versions are patched):

[root ~]# rpm -qa 'ea-php8*-php-cli' --qf '%{NAME} %{VERSION}-%{RELEASE} built:%{BUILDTIME:date}\n' | sort
ea-php83-php-cli 8.3.35-2.el8.cloudlinux.2 built:Wed 21 Oct 2026 12:48:35 PM EDT

[root ~]# rpm -q --changelog ea-php83-php-cli | grep -E 'CVE-2026-(109618|109619)'
  url_scanner_ex.c and ext/json/json_scanner.c for the CVE-2026-109618/109619 patch: el7/el8 re2c 0.14.3
- EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory

Please note that cPanel and CloudLinux are using their own custom-built RPM packages for PHP, so for cPanel, there is no PHP 8.3.36. The patched 8.3.35 version is 8.3.35-2 (Again, we use 8.3 as sample, all PHP versions are patched).

For the full list of PHP patched versions, please check 'CloudLinux EasyApache4' section in cPanel announcement:

https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619

The original post - October 21:

You may have seen news regarding recent critical PHP security vulnerabilities affecting servers worldwide. We want to reassure you that our team is actively monitoring the situation, and your websites are protected.

Here is what you need to know:

• Automated Patching: As soon as the official patches are released by our upstream vendors, we will install them across all hosting servers. There is no action required on your part.

• Active Protection: In the meantime, all servers are fully protected against active exploits by our Imunify360 Web Application Firewall (WAF) rulesets.

We are handling everything behind the scenes to keep your hosting environment safe and secure.

2MHost Support Team