Update: PHP builds with the PHP.net version numbers have been applied across all servers
Originally sent on 22-10-2026
This is a copy of the email notice that was initially sent out to clients.
We want to make you aware of two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, and explain what you should know.
We use Cloudlinux OS 8 and Imunify360 security suite on all our servers. Cloudlinux has already published fix releases for the alt-php packages that are provided for the cpanel accounts.
The fixed releases have already been applied across all our servers.
Additionally, Imunify360 has also published WAF rulesets that provide protection for the attack surfaces that could be used to exploit the vulnerabilities.
NOTE: Even though the fix has been applied, the PHP versions will not necessary change in your cpanel. This is due to how Cloudlinux implements and manages PHP packages. They have provided explanation on that, on their status page which is linked below.
We are actively monitoring the developments surrounding the announced vulnerabilities.
Cloudlinux Status page: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
Cloudlinux blog: https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619