{"id":5764,"date":"2026-10-21T11:12:47","date_gmt":"2026-10-21T15:12:47","guid":{"rendered":"https:\/\/underhost.com\/blog\/?p=5764"},"modified":"2026-10-23T08:29:01","modified_gmt":"2026-10-23T12:29:01","slug":"php-security-release-october-2026-patch-guide","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/php-security-release-october-2026-patch-guide\/","title":{"rendered":"PHP Critical Security Update (October 2026): Patch Guide, CloudLinux Status, CERT-EU Advice and Mitigations"},"content":{"rendered":"<div class=\"uh-blog-hero\" style=\"margin:0 0 40px;text-align:center;padding:48px 24px;border-radius:20px;background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;box-shadow:0 20px 40px -15px rgba(13,31,60,0.28);position:relative;overflow:hidden;\">\n<div style=\"display:inline-flex;align-items:center;gap:8px;padding:7px 14px;margin-bottom:16px;border:1px solid rgba(0,212,255,0.32);border-radius:999px;color:#DFF8FF;font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;background:rgba(0,212,255,0.10);\"><i class=\"fas fa-server\" style=\"color:#00D4FF;\"><\/i> Hosting Guide<\/div>\n<h1 style=\"color:#ffffff;font-size:clamp(32px,5vw,46px);line-height:1.12;margin:0 0 14px;font-weight:800;\">PHP Critical Security Update (October 2026): Patch Guide, CloudLinux Status, CERT-EU Advice and Mitigations<\/h1>\n<p style=\"font-size:18px;color:#EAF6FF;max-width:800px;margin:0 auto;line-height:1.7;\">PHP has announced two critical security vulnerabilities, rated CVSS v4.0 9.2, with a release on 21 October 2026. Here is how to check your PHP version and patch cPanel and non-panel servers.<\/p>\n<\/div>\n<div style=\"background:#FFF7ED;border:1px solid #FDBA74;border-radius:16px;padding:20px 22px;margin:24px 0;\">\n<h3 style=\"margin:0 0 10px;color:#9A3412;font-size:20px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#F97316;\"><\/i> Updated 21 October 2026.<\/h3>\n<p style=\"margin:0;color:#7C2D12;line-height:1.7;\">This guide follows CERT-EU security advisory 2026-018 and the PHP project release of 21 October 2026. Update to a fixed release first. If you cannot update straight away, the temporary mitigations below reduce exposure, but they do not fix the problem.<\/p>\n<\/div>\n<div class=\"uh-blog-excerpt\" style=\"border-left:4px solid #00D4FF;padding:18px 20px;margin:0 0 34px;background:#F8FAFC;color:#1F2937;border-radius:0 14px 14px 0;box-shadow:0 8px 28px rgba(13,31,60,0.08);line-height:1.75;\"><strong style=\"color:#0D1F3C;\">Short answer:<\/strong> Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow <strong>unauthenticated remote code execution<\/strong>. Both carry a CVSS v4.0 score of 9.2. The PHP project released fixes on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU advises organisations to patch immediately, and to isolate internet-facing applications where patching is not yet possible.<\/div>\n<nav class=\"uh-toc\" aria-label=\"Table of contents\" style=\"background:#ffffff;border:1px solid #E5E7EB;border-radius:16px;padding:20px 22px;margin:0 0 34px;box-shadow:0 4px 12px rgba(13,31,60,0.08);\">\n<div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#176EA5;margin-bottom:10px;\"><i class=\"fas fa-list\" style=\"color:#00D4FF;\"><\/i> In this guide<\/div>\n<ol style=\"margin:0;padding-left:20px;columns:2 260px;column-gap:28px;line-height:1.9;\">\n<li><a href=\"#what-the-advisory-says\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">What the advisory says<\/a><\/li>\n<li><a href=\"#who-is-at-risk\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Who is at risk<\/a><\/li>\n<li><a href=\"#affected-versions-and-fixed-releases\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Affected versions and fixed releases<\/a><\/li>\n<li><a href=\"#the-two-vulnerabilities\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">The two vulnerabilities<\/a><\/li>\n<li><a href=\"#patch-first-step-by-step\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Patch first: step by step<\/a><\/li>\n<li><a href=\"#cpanel-and-whm-servers\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">cPanel and WHM servers<\/a><\/li>\n<li><a href=\"#servers-without-a-control-panel\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Servers without a control panel<\/a><\/li>\n<li><a href=\"#cloudlinux-status-updated-22-october-2026\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">CloudLinux status (updated 22 October 2026)<\/a><\/li>\n<li><a href=\"#platform-specific-updates\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Platform-specific updates<\/a><\/li>\n<li><a href=\"#aapanel-servers\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">aaPanel servers<\/a><\/li>\n<li><a href=\"#cloudpanel-servers\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">CloudPanel servers<\/a><\/li>\n<li><a href=\"#if-you-cannot-patch-straight-away-temporary-miti\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">If you cannot patch straight away: temporary mitigations<\/a><\/li>\n<li><a href=\"#configuration-snippets-for-the-temporary-workaro\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Configuration snippets for the temporary workaround<\/a><\/li>\n<li><a href=\"#end-of-life-php-8-1-and-older\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">End-of-life PHP (8.1 and older)<\/a><\/li>\n<li><a href=\"#isolate-what-you-cannot-patch\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Isolate what you cannot patch<\/a><\/li>\n<li><a href=\"#support-dates\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Support dates<\/a><\/li>\n<li><a href=\"#what-underhost-has-done\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">What UnderHost has done<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"uh-post-content\" style=\"color:#1F2937;font-size:16px;line-height:1.75;\">\n<h2 id=\"what-the-advisory-says\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-info-circle\" style=\"color:#00D4FF;\"><\/i> What the advisory says<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">On 20 October 2026, the PHP project announced an upcoming security release for two critical vulnerabilities.<\/li>\n<li style=\"margin:0 0 8px;\">The fixes were released on 21 October 2026, in the four branches listed in the table below.<\/li>\n<li style=\"margin:0 0 8px;\">Technical details are now being discussed publicly, and initial proofs of concept have begun to circulate. CERT-EU says this raises the likelihood that attackers are already exploiting the vulnerabilities.<\/li>\n<\/ul>\n<h2 id=\"who-is-at-risk\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#00D4FF;\"><\/i> Who is at risk<\/h2>\n<p style=\"margin:0 0 18px;\">Every PHP installation that serves web requests is at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers mod_php the highest-risk setup, because a demonstrated exploit can trigger the attack with one unauthenticated request, before any application code runs.<\/p>\n<p style=\"margin:0 0 18px;\">Many commercial and open-source products use PHP internally, so they can be affected even if they do not show a PHP installation. CERT-EU recommends checking the NCSC-NL repository for third-party software that embeds PHP.<\/p>\n<h2 id=\"affected-versions-and-fixed-releases\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Affected versions and fixed releases<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;min-width:600px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">PHP branch<\/th>\n<th style=\"padding:14px;text-align:left;\">Affected before<\/th>\n<th style=\"padding:14px;text-align:left;\">Fixed in<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.5<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.5.12<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.5.12<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.4<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.4.27<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.4.27<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.3<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.3.36<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.3.36<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.2<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.2.35<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.2.35<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.1 and older<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">End of life<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">No upstream fix. Upgrade, or use vendor backports.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"the-two-vulnerabilities\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-shield-alt\" style=\"color:#00D4FF;\"><\/i> The two vulnerabilities<\/h2>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">CVE-2026-109618: memory corruption during out-of-memory handling<\/h3>\n<p style=\"margin:0 0 18px;\">PHP enforces the <code>memory_limit<\/code> setting by aborting any request that exceeds it. This can interrupt PHP while internal request data is only partly set up, for example while a form-based file upload is being parsed. Request cleanup may then treat the invalid data as valid, and try to free memory that was never initialised. CVSS v4.0: 9.2.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">CVE-2026-109619: stale global state<\/h3>\n<p style=\"margin:0 0 18px;\">Internal state owned by one request can survive after its memory has been freed, for example after a fatal error. A later request handled by the same worker may then use that stale state before the normal reset runs. CVSS v4.0: 9.2.<\/p>\n<h2 id=\"patch-first-step-by-step\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-shield-alt\" style=\"color:#00D4FF;\"><\/i> Patch first: step by step<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><strong>Find every PHP installation.<\/strong> Include PHP bundled with applications and vendor software, not only the system PHP.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Take a backup<\/strong> of the server or the site before you change anything.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Update to the fixed release<\/strong> for your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. CERT-EU notes that Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Restart every worker.<\/strong> Restart PHP-FPM, and Apache or Nginx. Apache with mod_php needs a full restart.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Confirm the version<\/strong> on each installation, and test the sites.<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>php -v\n\n# Debian and Ubuntu\nsudo apt update\napt list --upgradable 2&gt;\/dev\/null | grep -i php\n\n# AlmaLinux, Rocky Linux and RHEL\nsudo dnf update 'php*'\n\n# Restart the services that run PHP\nsudo systemctl restart php-fpm\nsudo systemctl restart httpd    # or nginx, or apache2 on Debian and Ubuntu<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">For control-panel steps, see our <a href=\"https:\/\/underhost.com\/blog\/php-security-release-october-2026-patch-guide\/\">PHP critical security update guide<\/a>, which covers cPanel and WHM with EasyApache 4 25.91, aaPanel, and CloudPanel.<\/p>\n<p style=\"margin:0 0 18px;\">For control-panel steps, the sections below cover cPanel and WHM, servers without a control panel, aaPanel and CloudPanel.<\/p>\n<h2 id=\"cpanel-and-whm-servers\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-server\" style=\"color:#00D4FF;\"><\/i> cPanel and WHM servers<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">In WHM, update cPanel &amp; WHM to the latest release. cPanel has published <strong>EasyApache 4 25.91<\/strong> (21 October 2026), which fixes both PHP vulnerabilities in ea-php74 through ea-php85.<\/li>\n<li style=\"margin:0 0 8px;\">Open <strong>WHM &gt; Software &gt; EasyApache 4<\/strong> and build the PHP versions you use. Rebuilding is what installs the fixed PHP packages.<\/li>\n<li style=\"margin:0 0 8px;\">Open <strong>MultiPHP Manager<\/strong> to check the PHP version on each domain.<\/li>\n<li style=\"margin:0 0 8px;\">Check the cPanel version and PHP version over SSH as root:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># cPanel and WHM version (must match the release you installed)\n\/usr\/local\/cpanel\/cpanel -V\n\n# Default PHP version on the server\nphp -v\n\n# Each EasyApache 4 PHP build (ea-php74 to ea-php85)\nls \/opt\/cpanel | grep ea-php<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">To run the cPanel update script from SSH, use the command below. Only run it if your WHM update has not already done so.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>\/scripts\/upcp --force<\/code><\/pre>\n<h2 id=\"servers-without-a-control-panel\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-server\" style=\"color:#00D4FF;\"><\/i> Servers without a control panel<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><strong>Inventory every PHP installation.<\/strong> Include PHP that ships inside applications or vendor software, not only the system PHP.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Update each one<\/strong> to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 using your distribution&#8217;s packages or your vendor&#8217;s packages.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Restart the services that run PHP<\/strong> (PHP-FPM, and Apache or Nginx). Apache with mod_php needs a full restart.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Confirm the version<\/strong> for each installation.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Isolate end-of-life PHP<\/strong> from the internet until you can upgrade it.<\/li>\n<\/ol>\n<p style=\"margin:0 0 18px;\">Example commands over SSH. Package and service names differ between distributions, so check them on your server first.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># Show the PHP version\nphp -v\n\n# Debian and Ubuntu: refresh packages and list PHP updates\nsudo apt update\napt list --upgradable 2&gt;\/dev\/null | grep -i php\n\n# AlmaLinux, Rocky Linux and RHEL: update PHP packages\nsudo dnf update 'php*'\n\n# Restart PHP-FPM and the web server (names vary by distribution)\nsudo systemctl restart php-fpm\nsudo systemctl restart httpd    # or apache2 on Debian and Ubuntu\n\n# Confirm the version again\nphp -v<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Use the package and service names your system shows, for example <code>systemctl list-units | grep -i php<\/code>. If a PHP version is not in your repositories, use your vendor&#8217;s packages instead of installing from source.<\/p>\n<h2 id=\"cloudlinux-status-updated-22-october-2026\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> CloudLinux status (updated 22 October 2026)<\/h2>\n<p style=\"margin:0 0 18px;\">This section follows the CloudLinux status updates of 22 October 2026, 09:21 UTC, which replace the earlier updates from 21 October. CloudLinux says its status changes often, so check its status page before you rely on this table. Native PHP, alt-php and ea-php are different packages. Use the commands for the package type you run.<\/p>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;min-width:600px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Package type<\/th>\n<th style=\"padding:14px;text-align:left;\">Status<\/th>\n<th style=\"padding:14px;text-align:left;\">Update command<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><strong>ea-php<\/strong> (cPanel EasyApache 4)<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Fixed packages are released for ea-php52 through ea-php85 on CloudLinux OS 7, 8, 9 and 10.<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">CloudLinux 7: <code>yum clean all &amp;&amp; yum update \"ea-php*\"<\/code><br \/>CloudLinux 8, 9, 10: <code>dnf clean all &amp;&amp; dnf upgrade \"ea-php*\"<\/code><br \/>Then: <code>\/scripts\/restartsrv_httpd<\/code> and <code>\/scripts\/restartsrv_apache_php_fpm<\/code><\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><strong>alt-php<\/strong><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Fixed packages are in the CloudLinux stable repositories for CloudLinux 7, 8 and 9 (released 22 October 2026, 00:07 UTC). On CloudLinux 10, alt-php 5.2 is in stable, and other versions are served from the ELS ALT PHP repository.<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">CloudLinux 7: <code>yum update 'alt-php*'<\/code><br \/>CloudLinux 8, 9, 10: <code>dnf upgrade 'alt-php*'<\/code><br \/>CloudLinux for Ubuntu: <code>apt-get update &amp;&amp; apt-get upgrade<\/code><br \/>Then restart Apache, PHP-FPM or LiteSpeed.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><strong>Native PHP<\/strong> (the operating system&#8217;s own php packages)<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">PHP 8.2 and 8.3 on CloudLinux 9, and PHP 8.2 on CloudLinux 8, are in stable. Other native versions are in the beta channel, with a gradual rollout that had reached about 0.2% of servers. CloudLinux 7 PHP 5.4 is a TuxCare ELS package.<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">A regular update installs the fixed packages once they reach your server. Restart PHP-FPM or the web server afterwards. Wait for the other versions to reach stable.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Confirm the fix<\/h3>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><strong>ea-php and alt-php:<\/strong> these packages carry the fix as a backport, so their version numbers stay below PHP&#8217;s. For example, ea-php84 is 8.4.26, not 8.4.27. Check the changelog for the CVE IDs:<\/li>\n<\/ul>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>rpm -q ea-php84-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'\nrpm -q --changelog alt-php82-common | grep -E 'CVE-2026-(109618|109619)'<\/code><\/pre>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><strong>Native PHP 8.2 and 8.3 (rebased):<\/strong> the changelog says only &#8220;rebase to 8.2.35&#8221; or &#8220;rebase to 8.3.36&#8221;, with no CVE IDs, so the changelog check returns nothing even on a fixed server. Check the version instead. It should be 8.2.35 or 8.3.36 or later:<\/li>\n<\/ul>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>rpm -q php-cli<\/code><\/pre>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><strong>Security metadata:<\/strong> OVAL and UpdateInfo data for these packages is not published yet. Security-only filters such as <code>yum --security<\/code> and <code>dnf updateinfo<\/code> will not list them. Use a regular update, as shown above.<\/li>\n<\/ul>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Imunify360 interim protection<\/h3>\n<p style=\"margin:0 0 18px;\">Servers with Imunify360 and its WAF enabled receive rulesets 8.83, 8.84 and 8.85 automatically. On ModSecurity (Apache and Nginx) and Coraza they block the known exploit requests and the public exploit tool. On LiteSpeed, ruleset 8.84 blocks the exploit tool and upload progress requests that do not come from the site&#8217;s own pages. No rule blocks the out-of-memory path of CVE-2026-109618 yet. This is an interim mitigation, not a fix. Patch as well.<\/p>\n<h2 id=\"platform-specific-updates\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Platform-specific updates<\/h2>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">EasyApache 4 packages (cPanel)<\/h3>\n<p style=\"margin:0 0 18px;\">cPanel has published fixed packages: ea-php82 8.2.35, ea-php83 8.3.36, ea-php84 8.4.27 and ea-php85 8.5.12. The nightly cPanel update installs them if automatic updates are on. To install them now, run the commands below as root, then check the versions.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>dnf update 'ea-php*'\n\/scripts\/restartsrv_apache_php_fpm\n\n# Check the installed EasyApache 4 PHP versions\ndnf list installed 'ea-php*'<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">cPanel&#8217;s packages for PHP 8.1 and older do not include the fix. Move those sites to PHP 8.2 or later in <strong>WHM &gt; MultiPHP Manager<\/strong>.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">CloudLinux (alt-php)<\/h3>\n<p style=\"margin:0 0 18px;\">If your PHP comes from CloudLinux alt-php, update it with:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>dnf update 'alt-php*'<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">AlmaLinux, Rocky Linux and RHEL: the Remi repository<\/h3>\n<p style=\"margin:0 0 18px;\">If your PHP comes from the Remi repository (rpms.remirepo.net), PHP says it will not have updates on release day. Switch to your distribution&#8217;s packages, or build from source.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Debian and Ubuntu<\/h3>\n<p style=\"margin:0 0 18px;\">Update with the commands below. This also picks up updates from the ondrej\/php repository if you use it.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo apt update &amp;&amp; sudo apt upgrade<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Docker and other containers<\/h3>\n<p style=\"margin:0 0 18px;\">Pull the new PHP base image, rebuild the image and redeploy. A running container keeps the old PHP until you replace it.<\/p>\n<p style=\"margin:0 0 18px;\">Linux distributions and LTS vendors received the patches in advance, so most should have packages today. If yours is not available yet, check again later, then install it and restart PHP-FPM or Apache.<\/p>\n<h2 id=\"aapanel-servers\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-server\" style=\"color:#00D4FF;\"><\/i> aaPanel servers<\/h2>\n<p style=\"margin:0 0 18px;\"><strong>Take a server snapshot or confirm your current backups before you start.<\/strong><\/p>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Open <strong>App Store<\/strong>, then click <strong>Update App List<\/strong>.<\/li>\n<li style=\"margin:0 0 8px;\">Under <strong>Installed<\/strong>, find PHP 8.2 and PHP 8.3 (and any other PHP version you run).<\/li>\n<li style=\"margin:0 0 8px;\">Use the <strong>Update<\/strong> action for one version at a time.<\/li>\n<li style=\"margin:0 0 8px;\">Check the installation log, then confirm the resulting version.<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>php -v<\/code><\/pre>\n<h2 id=\"cloudpanel-servers\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-server\" style=\"color:#00D4FF;\"><\/i> CloudPanel servers<\/h2>\n<p style=\"margin:0 0 18px;\"><strong>Take a backup or snapshot first.<\/strong> CloudPanel servers can be updated over SSH with the same package steps as servers without a control panel. Use the PHP packages from your operating system or vendor, as shown below.<\/p>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Connect over SSH as root, or as a user with sudo.<\/li>\n<li style=\"margin:0 0 8px;\">Check the PHP version the server runs, then update the PHP packages to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.<\/li>\n<li style=\"margin:0 0 8px;\">Restart PHP-FPM and Nginx.<\/li>\n<li style=\"margin:0 0 8px;\">Set the fixed version for each site in CloudPanel: open the site, go to the <strong>PHP Settings<\/strong> tab, select the version, and update.<\/li>\n<li style=\"margin:0 0 8px;\">Test each site, then check the PHP version again.<\/li>\n<\/ol>\n<p style=\"margin:0 0 18px;\">The per-site PHP setting is in the CloudPanel web interface. Check CloudPanel&#8217;s official documentation before you rely on any command-line steps for it.<\/p>\n<h2 id=\"if-you-cannot-patch-straight-away-temporary-miti\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-shield-alt\" style=\"color:#00D4FF;\"><\/i> If you cannot patch straight away: temporary mitigations<\/h2>\n<p style=\"margin:0 0 18px;\">CERT-EU stresses that only an update fully fixes these vulnerabilities. The measures below reduce exposure to specific attack paths, and they do not make an installation safe. Apply them only until the update is in place and verified.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">For CVE-2026-109618 (memory corruption)<\/h3>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Set <code>memory_limit=-1<\/code> in a way that applications cannot override, such as <code>php_admin_value<\/code> in the PHP-FPM pool or the Apache configuration. Check that no pool, directory or application setting puts a finite limit back.<\/li>\n<li style=\"margin:0 0 8px;\">Set a low <code>post_max_size<\/code>: 8M for applications that do not accept uploads, or 32M where uploads are needed. Keep <code>upload_max_filesize<\/code> below <code>post_max_size<\/code>.<\/li>\n<li style=\"margin:0 0 8px;\">Limit decoded request size, field count, multipart part count, header count and nesting depth at the web server or proxy. These limits must also cover requests without a usable Content-Length header.<\/li>\n<li style=\"margin:0 0 8px;\">Use a container or cgroup memory limit as an availability boundary. Do not use RLIMIT_AS or RLIMIT_DATA, because they can trigger the vulnerable allocation failure.<\/li>\n<\/ul>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">For CVE-2026-109619 (stale global state)<\/h3>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Set <code>session.upload_progress.enabled=0<\/code> in <code>php.ini<\/code>, or in a PHP-FPM pool, then restart every worker. Do not rely on <code>ini_set()<\/code> or <code>.user.ini<\/code>, because they take effect too late.<\/li>\n<li style=\"margin:0 0 8px;\">On PHP 8.5, set <code>fatal_error_backtraces=0<\/code> and restart every worker.<\/li>\n<li style=\"margin:0 0 8px;\">Fix fatal errors and execution timeouts that an attacker could reach, especially in upload and import processing.<\/li>\n<\/ul>\n<p style=\"margin:0 0 18px;\">Hiding diagnostics with <code>error_reporting<\/code>, <code>display_errors<\/code> or <code>@<\/code> does not help.<\/p>\n<h2 id=\"configuration-snippets-for-the-temporary-workaro\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Configuration snippets for the temporary workaround<\/h2>\n<p style=\"margin:0 0 18px;\">Use these settings only until the update is installed. They reduce exposure to the known attack paths, but they do not make a server safe. Set them server-wide, in <code>php.ini<\/code>, a PHP-FPM pool, or the Apache configuration. Use <code>php_admin_value<\/code> and <code>php_admin_flag<\/code>, because <code>ini_set()<\/code> and <code>.user.ini<\/code> take effect too late to help. Then restart every PHP worker.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">PHP-FPM pool<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>; e.g. \/etc\/php-fpm.d\/www.conf\nphp_admin_flag[session.upload_progress.enabled] = off\nphp_admin_value[post_max_size] = 8M\nphp_admin_value[memory_limit] = -1\n; PHP 8.5 only:\nphp_admin_flag[fatal_error_backtraces] = off<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Then restart PHP-FPM, for example <code>systemctl restart php-fpm<\/code>. A reload may leave old workers running.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Apache with mod_php<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># httpd.conf or the site's &lt;VirtualHost&gt;\nphp_admin_flag session.upload_progress.enabled off\nphp_admin_value post_max_size 8M\nphp_admin_value memory_limit -1<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Then restart Apache. mod_php is the highest-risk setup, so update these servers first.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">php.ini<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>session.upload_progress.enabled = 0\npost_max_size = 8M\nmemory_limit = -1\n; PHP 8.5 only:\nfatal_error_backtraces = 0<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">A pool, directory or application setting can override <code>php.ini<\/code>. Check that nothing sets a finite <code>memory_limit<\/code> back. On cPanel, use <strong>WHM &gt; MultiPHP INI Editor &gt; Editor Mode<\/strong> and repeat the settings for each PHP version.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">What these settings cost you<\/h3>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><strong>post_max_size = 8M<\/strong> caps form posts at 8 MB. If a site takes file uploads, use 32M instead, and keep <code>upload_max_filesize<\/code> below it.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>memory_limit = -1<\/strong> removes PHP&#8217;s per-request memory cap, so one runaway script can use all of the server&#8217;s memory. PHP recommends a container or cgroup memory limit as a backstop.<\/li>\n<li style=\"margin:0 0 8px;\">Upload progress bars stop working, but uploads themselves still work.<\/li>\n<\/ul>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Check that the settings took effect<\/h3>\n<p style=\"margin:0 0 18px;\">Create a file with a random name in the site&#8217;s document root, containing the line below. Open it in your browser and check <code>session.upload_progress.enabled<\/code>, <code>post_max_size<\/code> and <code>memory_limit<\/code>. Delete the file as soon as you have checked, because it exposes details about your server.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>&lt;?php phpinfo();<\/code><\/pre>\n<p style=\"margin:0 0 18px;\"><code>php -i<\/code> on the command line does not show the web settings, because the command line reads its own configuration.<\/p>\n<h2 id=\"end-of-life-php-8-1-and-older\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> End-of-life PHP (8.1 and older)<\/h2>\n<p style=\"margin:0 0 18px;\">The PHP project no longer ships updates for PHP 8.1 and older. Some distributions and LTS vendors backport fixes, so contact your vendor. The PHP team has also published minimal source backports for PHP 7.4, 8.0 and 8.1, for organisations that build from source. The safer option is to move the site to a supported branch.<\/p>\n<p style=\"margin:0 0 18px;\">The community repository rpms.remirepo.net will not have updates on release day. The PHP team urges users to switch to distribution packages or build from source.<\/p>\n<h2 id=\"isolate-what-you-cannot-patch\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-shield-alt\" style=\"color:#00D4FF;\"><\/i> Isolate what you cannot patch<\/h2>\n<p style=\"margin:0 0 18px;\">Where patching is not feasible, CERT-EU advises isolating internet-facing applications from public networks until the fix is applied and verified. Put the affected sites behind an access restriction, or take them offline until they are updated.<\/p>\n<h2 id=\"support-dates\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Support dates<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">PHP branch<\/th>\n<th style=\"padding:14px;text-align:left;\">Security support until<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.5<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">31 December 2029<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.4<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">31 December 2028<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.3<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">31 December 2027<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">8.2<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">31 December 2026 (end of life)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"what-underhost-has-done\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-info-circle\" style=\"color:#00D4FF;\"><\/i> What UnderHost has done<\/h2>\n<p style=\"margin:0 0 18px;\">All UnderHost shared hosting and managed customer servers have been patched. If you run an unmanaged VPS or dedicated server, update it yourself using the steps above.<\/p>\n<h2 id=\"sources\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-book\" style=\"color:#00D4FF;\"><\/i> Sources<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\/\">CERT-EU security advisory 2026-018<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/www.php.net\/index.php#2026-10-20-1\">PHP project announcement<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/github.com\/NCSC-NL\/php2shell\">NCSC-NL repository (third-party software that embeds PHP)<\/a><\/li>\n<\/ul>\n<p style=\"margin:0 0 18px;\">Need help with an update? Open a ticket through <a href=\"https:\/\/customerpanel.ca\/client\/\">@CustomerPanel<\/a>.<\/p>\n<div aria-hidden=\"true\" class=\"uh-section-divider\" style=\"width:min(100% - 32px, 1080px);margin:44px auto;display:grid;grid-template-columns:1fr 32px 1fr;align-items:center;gap:18px;pointer-events:none;\"><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(0,212,255,0.40),rgba(23,110,165,0.24),transparent);\"><\/span><img alt=\"\" decoding=\"async\" height=\"32\" loading=\"lazy\" src=\"https:\/\/cdn.underhost.com\/android-chrome-192x192.webp\" style=\"width:32px;height:32px;display:block;border-radius:8px;filter:drop-shadow(0 0 14px rgba(0,212,255,0.30));\" width=\"32\"\/><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(23,110,165,0.24),rgba(0,212,255,0.40),transparent);\"><\/span><\/div>\n<\/div>\n<div class=\"uh-blog-cta\" style=\"background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;padding:36px 24px;border-radius:20px;text-align:center;margin:44px 0;box-shadow:0 20px 40px -15px rgba(13,31,60,0.32);\">\n<h2 style=\"margin:0 0 12px;font-size:28px;line-height:1.25;color:#ffffff;\">Need help putting this into practice?<\/h2>\n<p style=\"font-size:17px;margin:0 auto 22px;color:#EAF6FF;max-width:720px;line-height:1.7;\">Our team can review your setup and help you choose the right plan. Contact @CustomerPanel for support.<\/p>\n<p><a href=\"https:\/\/underhost.com\/shared-hosting.php\" style=\"background:linear-gradient(90deg,#00D4FF,#0077FF);color:#ffffff;padding:13px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;\">View hosting plans<\/a><a href=\"https:\/\/customerpanel.ca\/client\/\" style=\"background:transparent;color:#ffffff;padding:12px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;border:1px solid rgba(255,255,255,0.32);\">Contact @CustomerPanel<\/a><\/div>\n<div class=\"uh-faq-section\" id=\"faq\" style=\"margin:34px 0;scroll-margin-top:90px;\">\n<h2 style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:0 0 18px;border-bottom:2px solid rgba(0,212,255,0.22);padding-bottom:10px;\">Frequently asked questions<\/h2>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Is PHP 8.1 or older affected?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">End-of-life PHP branches get no upstream fix. CloudLinux may ship backported fixes for some alt-php versions, so check the package changelog for the CVE IDs, and plan to move to a supported branch.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Do I need to restart anything after updating PHP?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. Restart PHP-FPM and the web server, so the new PHP binaries are loaded. Until then, the old version keeps running.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Are the temporary mitigations enough?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">No. They reduce exposure while you prepare the update, but only a fixed PHP release removes the vulnerabilities.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">How do I confirm that every site runs a fixed version?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Check each PHP version installed on the server, not only the default. On cPanel, MultiPHP Manager shows the version each domain uses, and <code>php -v<\/code> for each installed version shows the release number.<\/p>\n<\/div>\n<\/div>\n<p><script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.\"}}, {\"@type\": \"Question\", \"name\": \"Is PHP 8.1 or older affected?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"End-of-life PHP branches get no upstream fix. CloudLinux may ship backported fixes for some alt-php versions, so check the package changelog for the CVE IDs, and plan to move to a supported branch.\"}}, {\"@type\": \"Question\", \"name\": \"Do I need to restart anything after updating PHP?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. Restart PHP-FPM and the web server, so the new PHP binaries are loaded. Until then, the old version keeps running.\"}}, {\"@type\": \"Question\", \"name\": \"Are the temporary mitigations enough?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. They reduce exposure while you prepare the update, but only a fixed PHP release removes the vulnerabilities.\"}}, {\"@type\": \"Question\", \"name\": \"How do I confirm that every site runs a fixed version?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Check each PHP version installed on the server, not only the default. On cPanel, MultiPHP Manager shows the version each domain uses, and php -v for each installed version shows the release number.\"}}]}<\/script><\/p>\n<p><!-- uh-related-start --><\/p>\n<div style=\"background:#F4F8FC;border:1px solid #DCE7F3;border-radius:14px;padding:18px 22px;margin:32px 0 8px;\">\n<h2 style=\"margin:0 0 12px;font-size:22px;\">Related guides<\/h2>\n<ul style=\"margin:0;padding-left:20px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/nodejs-security-update-october-2026-cve-2026-111497\/\">Node.js Security Update (October 2026): CVE-2026-111497<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/critical-cpanel-authentication-bypass-patch-now-cve-2026-41940\/\">Critical cPanel Authentication Bypass &#8211; Patch Now (CVE-2026-41940)<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/updated-2025-php-version-support-on-cpanel-servers\/\">PHP Version Support on cPanel Servers (Updated October 2026)<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-to-optimize-php-performance-in-cpanel-with-multiphp-manager-cloudlinux-php-selector\/\">How to Optimize PHP Performance in cPanel with MultiPHP Manager &amp; CloudLinux PHP Selector<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/top-cpanel-security-tips-to-keep-your-hosting-environment-safe\/\">Top cPanel Security Tips to Keep Your Hosting Environment Safe<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- uh-related-end --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>PHP has announced two critical security vulnerabilities, rated CVSS v4.0 9.2, with a release on 21 October 2026. Here is how to check your PHP version and patch cPanel and non-panel servers.<\/p>\n","protected":false},"author":20904,"featured_media":5900,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[81,203,204],"tags":[110,108,187,188,185,186],"class_list":["post-5764","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hosting-guides","category-security","category-software-cms","tag-tag-cloudlinux","tag-tag-cpanel","tag-easyapache","tag-patch","tag-php","tag-security-updates"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5764","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/20904"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=5764"}],"version-history":[{"count":16,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5764\/revisions"}],"predecessor-version":[{"id":6768,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5764\/revisions\/6768"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/5900"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=5764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=5764"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=5764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}