Important PHP Security Update – CVE-2026-109618 & CVE-2026-109619

Oct 24, 2026

Like0 Likes

0 Comments

Share

• facebook
• linkedin

Important PHP Security Update – CVE-2026-109618 & CVE-2026-109619

VPSBlocks is aware of two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (Critical) announced on Wednesday 21st of October 2026.

These vulnerabilities affect the PHP runtime itself, potentially allowing unauthorised remote code execution. They affect PHP-powered websites across the hosting industry, regardless of hosting provider or control panel or server operating system. The PHP-powered websites include those built on WordPress, Joomla, Magento, Drupal and many more.

Current Patch Availability

The PHP Development Team has released security patches, and the following software vendors have confirmed the availability of updated packages:

• cPanel/WHM: Security patches have been released for PHP 7.4 through to PHP 8.5 via EasyApache 4.
• Plesk: Security patches have been released for PHP 7.4 through to PHP 8.5 on Linux, and PHP 8.2 through to PHP 8.5 on Windows.
• CloudLinux: Security patches have been released for supported PHP packages, including older PHP versions.
• Virtuozzo Cloudlets: PHP updates depend on the application server images deployed, and individual environments should be checked to confirm their patch status.

VPSBlocks servers are being updated as applicable patches become available. Our cPanel & Plesk VPS servers are provisioned with automatic updates enabled by default, although customers should verify that their server has received the relevant fixes.

What Should Customers Do?

We strongly recommend that all customers ensure their PHP installations are updated with the appropriate security patches.

While patches for these specific vulnerabilities have been made available for PHP 7.4 and newer through cPanel and Plesk Linux, older PHP releases remain officially unsupported by the PHP Development Team.

We strongly encourage customers to upgrade their websites and applications to PHP 8.3 or newer, preferably PHP 8.4 or 8.5 where application compatibility permits, to maintain ongoing security support.

Customers operating self-managed VPSs or Cloudlets environments should review their installed PHP versions and apply the relevant updates.

How to Identify Patched PHP Versions

*cPanel, Plesk and SOME Linux vendors do have patches released for previous versions of PHP. Below is a short list of patched 7.4 PHP versions. CL = CloudLinux.

We Are Here to Help

We understand the seriousness of these vulnerabilities and want to reassure our customers that VPSBlocks is actively addressing the situation.

Our support team is available to assist customers with identifying affected PHP installations, applying available security patches and providing guidance on upgrading to supported PHP versions.

If you require assistance or have concerns about your server’s security, please contact our support team through your VPSBlocks portal.

Neil has over 25 years of experience in the hosting and technology industry and has been a part of VPSBlocks for a few years. His background spans server infrastructure, application development, and digital strategy, giving him a practical understanding of how technology supports real business outcomes. Neil works closely with clients to design, optimise, and support hosting environments that are reliable, scalable, and aligned to their needs.

Neil