Critical PHP Security Update (CVE-2026-109618 & CVE-2026-109619)

What happened

On 21 October 2026 the PHP project released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2). Both allow an unauthenticated attacker to run code on a server that serves PHP websites. Attacks were already observed before the fix was released.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every earlier release is affected. PHP 8.1 and older will not receive a fix from the PHP project.

The PHP project states that updating is the only complete fix. Firewalls (including Cloudflare) and configuration changes reduce risk but do not make a server safe.

Please do not ignore this notice. This affects WordPress, WooCommerce, Magento, Drupal, Joomla, Laravel, WHMCS and every other PHP application.

Fully managed and shared hosting customers

No action is needed from you for the server-level update. Our team is updating PHP on all fully managed Plesk and cPanel servers and on all SoftSys shared hosting servers as our control panel and OS vendors publish patched builds.

• Updates are being applied in a rolling window starting 21 October 2026. We expect brief PHP service restarts (a few seconds per site) and no planned downtime.
• Where a patched build is not yet available from the vendor, we are applying interim protective settings and web firewall rules.
• We will update this announcement when all managed and shared servers are patched.

One exception needs your action: if your website or application runs on an end-of-life PHP version, we cannot patch it. See the next section.

Action required: sites on end-of-life PHP versions

If your site uses PHP 8.1 or older, move it to PHP 8.3 (recommended) or 8.2 as soon as possible. These versions get no fix from the PHP project, so they stay vulnerable whatever we do at server level.

How to upgrade your application

1. Take a full backup of files and database.
2. Update your application, theme and plugins/modules first to versions that support PHP 8.3. Older versions of WordPress plugins, WHMCS, Magento and similar may break on newer PHP.
3. Switch the PHP version for your domain:
   • cPanel: MultiPHP Manager (or Select PHP Version on CloudLinux servers).
   • Plesk: Domains → your domain → PHP Settings → PHP version.
4. Test your site: front end, login, forms, checkout or payments, and admin area.
5. If something breaks, switch back temporarily and open a ticket. Our team can assess compatibility and quote for upgrade assistance.

If your application cannot run on PHP 8.2 or later today, contact us. We can help isolate it or restrict access while you plan the upgrade.

Self-managed servers: update steps

You are responsible for patching self-managed servers. Please do it today. Take a snapshot or backup first. Control panel vendors build their own PHP packages, so a patched build may appear a few hours after the PHP release. If the commands below show no update yet, retry later in the day.

cPanel / WHM (Linux)

# AlmaLinux / Rocky / CloudLinux
dnf update 'ea-php*'
# CloudLinux alt-php (if used)
dnf update 'alt-php*'
# Ubuntu cPanel
apt update && apt install --only-upgrade 'ea-php*'

# Restart PHP and Apache
/scripts/restartsrv_apache_php_fpm
/scripts/restartsrv_httpd

# Verify each installed version
/opt/cpanel/ea-php83/root/usr/bin/php -v

Plesk (Linux)

plesk installer --select-release-current --upgrade-installed-components
# or only the PHP packages:
dnf update 'plesk-php*'      # AlmaLinux / Rocky / RHEL
apt update && apt install --only-upgrade 'plesk-php*'   # Ubuntu / Debian

plesk bin php_handler --reread
systemctl restart plesk-php83-fpm   # repeat for each version you use

# Verify
for v in /opt/plesk/php/*/bin/php; do echo "$v: $($v -r 'echo PHP_VERSION;')"; done

Sites set to the OS vendor PHP handler are updated through the operating system packages (see next section).

Linux without a control panel

# Debian / Ubuntu (deb.sury.org / Ondrej PPA packages)
apt update && apt install --only-upgrade 'php8.*'
systemctl restart php8.3-fpm   # each version; then apache2 or nginx

# AlmaLinux / Rocky / RHEL (Remi repository)
dnf update 'php*'              # module streams
dnf update 'php8*-php*'        # Remi SCL packages
systemctl restart php-fpm      # or php83-php-fpm; then httpd or nginx

• Distribution-supplied PHP (Ubuntu, Debian, RHEL stock packages): install your distribution's security update when published. These fixes are often backported, so php -v may still show the old version number. Check the package changelog instead.
• Remi repository: updates may arrive later than other sources. Keep interim protections in place until they do.
• Docker / containers: pull the updated official images (php:8.3-fpm and similar), rebuild your images and redeploy. Running containers are not updated automatically.

Plesk (Windows)

1. Go to Tools & Settings → Updates → Add/Remove Components and update the installed PHP components. Or run plesk installer --select-release-current --upgrade-installed-components from an administrator command prompt.
2. Recycle the IIS application pools, or run iisreset during a quiet period.
3. Verify with php.exe -v in each folder under C:\Program Files (x86)\Plesk\Additional\PleskPHPxx.

Windows IIS / SolidCP (manually installed PHP)

1. Download the Non Thread Safe (NTS) x64 zip for your PHP branch from windows.php.net. Match the Visual C++ build of your current install.
2. Extract it to a new folder, for example C:\PHP\8.3.36.
3. Copy your existing php.ini and any third-party extension DLLs (such as ionCube) into the new folder.
4. Point IIS Handler Mappings / FastCGI Settings and the PHP path in SolidCP's web service settings to the new folder. Alternatively, rename folders so the existing path stays the same.
5. Run iisreset, then confirm with php -v and a temporary phpinfo() page (delete it afterwards). Keep the old folder until you have confirmed everything works.

Verify, interim protection and support

Check the version your website actually uses, not only the command line. A server can have several PHP versions installed. Create a temporary file containing <?php echo PHP_VERSION; in your site, open it in a browser, confirm it shows 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor-patched build), then delete it.

If you cannot update immediately, these steps reduce exposure but do not make a server safe:

• Put the site behind a web application firewall such as Cloudflare (proxied), and allow web traffic to the server only from the firewall's IP ranges.
• Restrict admin areas (/wp-admin, WHMCS /admin, Magento admin) to your own IP addresses.
• Apply the PHP project's published interim settings in your PHP-FPM pool or server configuration, for example session.upload_progress.enabled = 0 and lower post_max_size limits. See the PHP security advisory for the full list.
• Consider taking non-essential sites offline until they are patched.

Need help? Open a ticket with our support team. Fully managed customers can ask us to confirm their server's status. Self-managed customers can request assisted patching or application upgrades (charges may apply).

Sources

• PHP 8.2.35 release announcement
• Phoronix: PHP updates released for two critical vulnerabilities
• Brandefense: affected and fixed versions, support dates
• Patchstack: live alert