CVE-2026-109618 & CVE-2026-109619 — Critical PHP RCE: How to Patch

Disclosed 21 October 2026. Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) can allow remote code execution. cPanel (EasyApache 4) and CloudLinux (ALT-PHP) have released patched PHP packages — update your server now. The steps below take about two minutes and do not affect your sites' data.

Using DirectAdmin or Plesk? The steps below are for cPanel and CloudLinux. Follow the DirectAdmin guide or the Plesk guide instead.

Am I affected?

Any server running PHP is affected until updated. This applies to both PHP stacks on a cPanel + CloudLinux server:

• EasyApache 4 PHP (ea-php74 … ea-php84)
• CloudLinux ALT-PHP (alt-php74 … alt-php84)

Run these as root. They search each installed PHP package's changelog for the two CVE IDs:

cPanel EasyApache 4:

CloudLinux ALT-PHP:

Any line showing "NOT fixed yet" needs the update below.

cPanel (EasyApache 4 PHP):

yum update 'ea-php*'

CloudLinux (ALT-PHP):

yum update 'alt-php*'

You can run both. (On most servers these two commands cover everything.)

/scripts/restartsrv_apache_php_fpm
/scripts/restartsrv_httpd

LiteSpeed users: also recycle the detached PHP processes:

/usr/local/lsws/bin/lswsctrl restart

Re-run the Step 1 check — every package should now show the CVE in its changelog (no "NOT fixed yet"). Your sites should load normally.

End-of-life PHP (7.4 / 8.0 / 8.1)

PHP branches that have reached end-of-life (such as 7.4, 8.0 and 8.1) only receive this fix through Extended Life Support (ELS), which is included with your CloudLinux licence:

• CloudLinux ALT-PHP ELS:
  Terminal

  Copy

  tslzCLN --tuxcare

• cPanel EA-PHP ELS (phpels): see our guide — TuxCare ELS + KernelCare Now Included With Your CloudLinux License.

If an EOL PHP version still shows "NOT fixed yet" after updating, enable ELS (above) and re-run

yum update

On some CloudLinux 9 servers the update can stop with a dependency error mentioning libavif (EPEL ships a conflicting libavif version). If you see that:

yum update 'ea-php*' 'alt-php*' --disablerepo=epel

If it still conflicts, update during a brief maintenance window with:

yum update 'ea-php*' 'alt-php*' --allowerasing

and re-check that your sites load afterward.

Managed-service customers

If your server is under one of our Server Management plans, we've already applied this patch for you — no action needed. If you're not sure, or you'd like us to patch it for you, just open a ticket and share access and we'll handle it and verify.