CVE-2026-109618 & CVE-2026-109619 — Critical PHP RCE: How to Patch
Disclosed 21 October 2026. Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) can allow remote code execution. cPanel (EasyApache 4) and CloudLinux (ALT-PHP) have released patched PHP packages — update your server now. The steps below take about two minutes and do not affect your sites' data.
Am I affected?
Any server running PHP is affected until updated. This applies to both PHP stacks on a cPanel + CloudLinux server:
- EasyApache 4 PHP (
ea-php74…ea-php84) - CloudLinux ALT-PHP (
alt-php74…alt-php84)
Step 1 — Check whether your PHP is already patched
Run these as root. They search each installed PHP package's changelog for the two CVE IDs:
cPanel EasyApache 4:
for p in $(rpm -qa 'ea-php*-php-common' | sort); do echo "== $p"; rpm -q --changelog "$p" | grep -iE 'CVE-2026-10961[89]' || echo " NOT fixed yet"; done
CloudLinux ALT-PHP:
for p in $(rpm -qa 'alt-php*-common' | sort); do echo "== $p"; rpm -q --changelog "$p" | grep -iE 'CVE-2026-10961[89]' || echo " NOT fixed yet"; done
Any line showing "NOT fixed yet" needs the update below.
Step 2 — Apply the update
cPanel (EasyApache 4 PHP):
yum update 'ea-php*'CloudLinux (ALT-PHP):
yum update 'alt-php*'You can run both. (On most servers these two commands cover everything.)
Step 3 — Restart PHP so the patched build loads
/scripts/restartsrv_apache_php_fpm
/scripts/restartsrv_httpdLiteSpeed users: also recycle the detached PHP processes:
/usr/local/lsws/bin/lswsctrl restartStep 4 — Verify
Re-run the Step 1 check — every package should now show the CVE in its changelog (no "NOT fixed yet"). Your sites should load normally.
End-of-life PHP (7.4 / 8.0 / 8.1)
PHP branches that have reached end-of-life (such as 7.4, 8.0 and 8.1) only receive this fix through Extended Life Support (ELS), which is included with your CloudLinux licence:
- CloudLinux ALT-PHP ELS:
RcLicenseCLN --tuxcare - cPanel EA-PHP ELS (phpels): see our guide — TuxCare ELS + KernelCare Now Included With Your CloudLinux License.
If an EOL PHP version still shows "NOT fixed yet" after updating, enable ELS (above) and re-run
yum updateTroubleshooting — "libavif" conflict on CloudLinux 9
On some CloudLinux 9 servers the update can stop with a dependency error mentioning libavif (EPEL ships a conflicting libavif version). If you see that:
yum update 'ea-php*' 'alt-php*' --disablerepo=epelIf it still conflicts, update during a brief maintenance window with:
yum update 'ea-php*' 'alt-php*' --allowerasingand re-check that your sites load afterward.
Managed-service customers
If your server is under one of our Server Management plans, we've already applied this patch for you — no action needed. If you're not sure, or you'd like us to patch it for you, just open a ticket and share access and we'll handle it and verify.