Security Update – PHP Patched for Critical Vulnerabilities

Subject: Security Update – PHP Patched for Critical Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

Dear Valued Customers,

On 21 October 2026, the PHP project released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that could allow remote code execution on affected servers.

DataKL Solutions has applied the patched PHP packages released by cPanel (EasyApache 4 ea-php) and CloudLinux (alt-php) across our shared and reseller hosting servers. PHP services have been restarted, and the updates are now active.

What this means for you

• No action is required from you.
• Your websites remain fully operational.
• Servers protected by Imunify360 also received updated firewall rules to block known exploit attempts.

For any questions, please open a ticket with our support team.

Thank you,
DataKL Solutions Sdn. Bhd.

Cloudlinux Status Cloudlinux Status
cPanel Updates cPanel

Why fixed alt-php and ea-php packages show an older PHP version

PHP.net fixed CVE-2026-109618 and CVE-2026-109619 in new PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35). Cloudlinux alt-php and ea-php packages carry the same fix applied to the PHP version they already shipped (a backport). For example, the fixed alt-php85 is 8.5.11-5, and the fixed ea-php84 is 8.4.26-2.el8.cloudlinux.1 on CloudLinux OS 8. These packages contain the fix for both CVEs, even though the PHP version number is lower. Reports that "PHP 8.5.11 is vulnerable" refer to the original PHP.net release, not to these packages.