Update: Security Patches Deployed for PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)
We have deployed security updates across our cPanel, DirectAdmin, and Webuzo hosting environments to address the recent PHP vulnerabilities.
Shared Hosting Proactive Mitigations Before the official PHP updates were even released, we proactively forced session.upload_progress.enabled=0 across all shared hosting servers as a partial mitigation. We also deployed custom Web Application Firewall (WAF) rules to inspect and protect multi-part uploads against this exploit. These servers are now receiving the full PHP patches as outlined below.
cPanel Servers For cPanel systems, the fixes are applied as backports. This means your PHP version number will not change to the latest upstream release (for example, ea-php84 remains at 8.4.26 instead of showing 8.4.27).
To confirm the fix is active on a cPanel server, you need to check the package changelog for the CVE IDs rather than looking at the PHP version number. You can verify this via SSH using the following command (replace ea-php84 with your installed version):rpm -q ea-php84-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'
DirectAdmin Servers On DirectAdmin, modern PHP branches have been updated to the fully patched upstream releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For older, legacy PHP versions (5.6 through 8.1), the security fixes have been successfully applied as custom patches through CustomBuild.
Webuzo Servers For Webuzo environments, all PHP packages spanning versions 5.6 through 8.5 are available for updates by logging into webuzo
Manual Workaround for Unmanaged Servers If you are running an unmanaged server and cannot apply the PHP updates immediately, you can temporarily mitigate the vulnerability by disabling session upload progress. To do this, add or update the following line in your active php.ini file:session.upload_progress.enabled=0 while updates applied.
Posted Oct 22, 2026 - 07:54 EDT
Update
directadmin legacy and cloudlinux are patched and going through final checks.
Posted Oct 21, 2026 - 20:14 EDT
Update
directadmin storage systems (with out cloudlinux) have been patched
Posted Oct 21, 2026 - 20:10 EDT
Update
All cpanel systems ea-php* packages have been updated. However some include back ports such as ea-php84 is 8.4.26, not 8.4.27.
Posted Oct 21, 2026 - 19:32 EDT
Update
Cpanel has released 8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33 and these are now being applied.
Posted Oct 21, 2026 - 11:41 EDT
Update
Directadmin custombuild is available: This moves PHP 8.5, 8.4, 8.3, 8.2 to latest version, and adds patches for PHP 8.1, PHP 8.0 and PHP 7.4
Please be aware PHP lower than 7.4 will be removed, if installed through custombuild at this time. PHP selector from cloudlinux will patch via alt-php.
Posted Oct 21, 2026 - 10:18 EDT
Update
Imunify360 has release ModSecurity ruleset 8.83 which targets the PHP session upload progress handling of multipart requests, plus a telemetry rule to track related activity. All webhosting servers have been verified to be running this version.
Storage directadmin does not offer imunify360. These run modsecurity with owasp ruleset.
Posted Oct 21, 2026 - 08:27 EDT
Update
On shared hosting systems with in the last few hours session.upload_progress.enabled = Off Has been set off with in php.ini as all as in litespeed under the main config file using php_value. This closes a possible part of of the exploit, but officially this mitigation does not come directly from PHP devs.
Posted Oct 21, 2026 - 07:34 EDT
Update
The official PHP project will likely not provide security patches for versions older than PHP 8.2.
Servers running cPanel or DirectAdmin with CloudLinux utilize HardenedPHP and will receive these patches over time. Standard DirectAdmin servers without CloudLinux do not currently support HardenedPHP, though we are actively consulting with the CloudLinux team to determine if standalone Imunify360 servers can utilize it.
Additionally, if the exploit is within PHP-FPM, servers running LiteSpeed are likely unaffected.
Depending on the severity of the issue, sites on non-CloudLinux systems without HardenedPHP may be required to update to PHP 8.2 or higher, or migrate to a CloudLinux system (which will require an IP address change).