Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 14:00 UTC

Incident Report for CloudLinux

Update

Correction: keep the ELS ALT PHP repository enabled

Our update of 22 October, 01:19 UTC said that servers that added the ELS ALT PHP repository (php-els) as a temporary workaround could disable it again. That is not correct. Please keep the repository enabled.

The ELS ALT PHP repository (repo.alt.tuxcare.com) is becoming the single source of alt-php and other ALT packages. CloudLinux OS 10 already receives them only from this repository, and CloudLinux OS 7, 8 and 9 will follow.

If you already disabled it, enable it again:
CloudLinux OS 7: yum-config-manager --enable php-els
CloudLinux OS 8, 9: dnf config-manager --set-enabled php-els
Posted Oct 23, 2026 - 21:36 UTC

Update

ea-php builds with the PHP.net version numbers are released

ea-php (cPanel EasyApache 4) builds with the PHP.net version numbers are now in the stable repositories:
- ea-php82: 8.2.35-1, for CloudLinux OS 7, 8, 9, 10 and CloudLinux OS for Ubuntu 22.04
- ea-php83: 8.3.36-1, for CloudLinux OS 7, 8, 9, 10 and CloudLinux OS for Ubuntu 22.04
- ea-php84: 8.4.27-1, for CloudLinux OS 8, 9, 10 and CloudLinux OS for Ubuntu 22.04
- ea-php85: 8.5.12-1, for CloudLinux OS 8, 9, 10 and CloudLinux OS for Ubuntu 22.04

A regular update installs them:
CloudLinux OS 7: yum clean all && yum update "ea-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "ea-php*"
CloudLinux OS for Ubuntu 22.04: apt-get update && apt-get upgrade

Then restart Apache and PHP-FPM:
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm

To check the installed version, for example: rpm -q ea-php84-php-cli (on Ubuntu: dpkg -l ea-php84-php-cli)

The alt-php builds with the PHP.net version numbers from our previous update (alt-php82 8.2.35-1, alt-php83 8.3.36-1, alt-php84 8.4.27-1, alt-php85 8.5.12-1) are also in the stable repository for CloudLinux OS 7: yum clean all && yum update "alt-php*"

If you have already installed the fixed packages from our earlier updates (for example ea-php84 8.4.26-2.el8.cloudlinux.1), your servers are already protected against CVE-2026-109618 and CVE-2026-109619. This update only brings the version numbers in line with PHP.net.
Posted Oct 23, 2026 - 13:10 UTC

Update

alt-php builds with the PHP.net version numbers are released

As announced in our 14:31 UTC update, alt-php builds with the PHP.net version numbers are now in the stable repositories for CloudLinux OS 8 and 9:
- alt-php82: 8.2.35-1
- alt-php83: 8.3.36-1
- alt-php84: 8.4.27-1
- alt-php85: 8.5.12-1

A regular update installs them:
dnf clean all && dnf upgrade "alt-php*"

Then restart your PHP services (Apache, PHP-FPM or LiteSpeed).

To check the installed version, for example: rpm -q alt-php85-common

If you have already installed the fixed packages from our earlier updates (for example alt-php85 8.5.11-5), your servers are already protected against CVE-2026-109618 and CVE-2026-109619. This update only brings the version numbers in line with PHP.net.
Posted Oct 23, 2026 - 00:08 UTC

Update

Fixed native PHP packages from the CloudLinux OS repositories are now in the stable channel for every affected version. A regular package update installs them:

• CloudLinux OS 10: PHP 8.3
• CloudLinux OS 9: PHP 8.0, 8.1, 8.2 and 8.3
• CloudLinux OS 8: PHP 7.2, 7.3, 7.4, 8.0 and 8.2
• CloudLinux OS 7: PHP 5.4 (TuxCare ELS)

To confirm the fix:
• PHP 8.3 on CloudLinux OS 10, PHP 8.2 and 8.3 on CloudLinux OS 9, and PHP 8.2 on CloudLinux OS 8: check the version with rpm -q php-cli. It should be 8.2.35 or 8.3.36 or later. The changelog of these builds does not list the CVE IDs.
• All other versions: check the changelog for the CVE IDs with rpm -q --changelog php-cli | grep -E "CVE-2026-(109618|109619)"
Posted Oct 22, 2026 - 19:50 UTC

Update

Why fixed alt-php and ea-php packages show an older PHP version

PHP.net fixed CVE-2026-109618 and CVE-2026-109619 in new PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35). Our alt-php and ea-php packages carry the same fix applied to the PHP version they already shipped (a backport). For example, the fixed alt-php85 is 8.5.11-5, and the fixed ea-php84 is 8.4.26-2.el8.cloudlinux.1 on CloudLinux OS 8. These packages contain the fix for both CVEs, even though the PHP version number is lower. Reports that "PHP 8.5.11 is vulnerable" refer to the original PHP.net release, not to these packages.

To check a server, look for the CVE IDs in the package changelog, e.g.:
rpm -q --changelog alt-php85-common | grep -E 'CVE-2026-(109618|109619)'
rpm -q --changelog ea-php84-php-cli | grep -E 'CVE-2026-(109618|109619)'

Next: We will publish alt-php builds with the PHP.net version numbers after the Node.js package release that is in progress now (status). ea-php will move to the new version numbers as we continue syncing with cPanel EasyApache 4.
If you have already installed the fixed packages, no further action is needed.
Posted Oct 22, 2026 - 14:31 UTC

Update

If the PHP update fails or finds nothing to install, check the cloudlinux-release package first

Some servers cannot install the fixed packages because their cloudlinux-release package is outdated. Check the installed version:
rpm -q cloudlinux-release

The current stable versions are:
- CloudLinux OS 7: 7.9-2.17
- CloudLinux OS 8: 8.10-16
- CloudLinux OS 9: 9.8-3
- CloudLinux OS 10: 10-5

(see changelog.cloudlinux.com/cloudlinux-release, switch el9 to your OS)

If yours is older, update it, clear the cache and run the PHP update again:
CloudLinux OS 7: yum update cloudlinux-release && yum clean all
CloudLinux OS 8, 9, 10: dnf update cloudlinux-release && dnf clean all

Then repeat the update steps from our previous updates, for example dnf upgrade 'ea-php*' or dnf upgrade 'alt-php*'
Posted Oct 22, 2026 - 13:17 UTC

Update

Correction to our 05:23 UTC update on native PHP packages (the operating system's own php packages, not alt-php or ea-php).

Native PHP 8.2 and 8.3 on CloudLinux 9 and PHP 8.2 on CloudLinux 8 are in stable, and a regular update installs them.

The fixed builds for the other native versions are not in stable yet. They are in the beta channel (updates-testing), and a gradual rollout has delivered them to about 0.2% of servers so far. This covers CloudLinux 10 PHP 8.3, CloudLinux 9 PHP 8.0 and 8.1, and CloudLinux 8 PHP 7.2, 7.4 and 8.0. PHP 5.4 on CloudLinux 7 is a TuxCare ELS package and does not go through this rollout.

Native PHP 8.2 and 8.3 in stable are rebased to the PHP releases. Their changelog says only "rebase to 8.2.35" or "rebase to 8.3.36" and names no CVE IDs, so the changelog grep from our earlier updates returns nothing on them even when the server is fixed. Check the version instead. It should be 8.2.35 or 8.3.36 or later.
rpm -q php-cli

For alt-php, ea-php and the other native builds, the changelog check from the earlier updates still applies. Details are in step 3 of the blog article.
Posted Oct 22, 2026 - 09:21 UTC

Update

Fixed native PHP packages from the CloudLinux repositories (the operating system's own php packages, not alt-php or ea-php) are rolling out gradually through the stable channel. Most servers don't have them yet.

Native php packages rolling out now: CloudLinux 10 PHP 8.3, CloudLinux 9 PHP 8.0 and 8.1, CloudLinux 8 PHP 7.2, 7.4 and 8.0, CloudLinux 7 PHP 5.4. The native PHP 7.3 fix for CloudLinux 8 is still being prepared. Native PHP 8.2 and 8.3 on CloudLinux 9 and PHP 8.2 on CloudLinux 8 are already in stable.

A regular package update installs them once they reach your server. Restart PHP-FPM or the web server afterwards. alt-php and ea-php are not affected by this rollout, their fixed packages are already in stable. Details are in step 3 of the blog article.
Posted Oct 22, 2026 - 05:23 UTC

Update

Fixed alt-php packages for CVE-2026-109618 and CVE-2026-109619 are available in the CloudLinux OS repositories

The release to the CloudLinux OS stable repositories is complete (22 October 2026, 00:07 UTC):
- CloudLinux OS 7, 8 and 9: alt-php 5.2-5.6, 7.0-7.4 and 8.0-8.5
- CloudLinux OS for Ubuntu 22.04: alt-php 5.2, 5.6, 7.0-7.4 and 8.0-8.5 (in stable since 21 October, 21:48 UTC)
- CloudLinux OS 10: alt-php 5.2 (in stable since 21 October, 22:14 UTC); all other alt-php versions on CloudLinux OS 10 come from the ELS ALT PHP repository, where they are already available

TuxCare ELS: all fixed packages are released (alt-php, the distribution's own PHP packages and PHP for Windows).

A regular update now installs the fixed packages, and the ELS ALT PHP repository is no longer needed:
CloudLinux OS 7: yum clean all && yum update "alt-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "alt-php*"
CloudLinux OS for Ubuntu: apt-get update && apt-get upgrade

Then restart your PHP services (Apache, PHP-FPM or LiteSpeed).

To confirm a version is fixed, check its changelog (for example, alt-php74):
rpm -q --changelog alt-php74-common | grep -E "CVE-2026-(109618|109619)"

Security advisory metadata (OVAL and UpdateInfo) is not published yet, so security-only updates such as yum --security do not list these packages. Use a regular update, as shown above.

For more details, please see our blog article: PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection
Posted Oct 22, 2026 - 01:19 UTC

Update

Last updated 21 October 2026, 23:00 UTC

- PHP released fixes for both critical vulnerabilities (CVSS v4.0 9.2): 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Update to the version for your branch. CloudLinux packages carry the fix as a backport and keep their own, lower version numbers, so confirm them by changelog instead (step 3). PHP 8.2 reaches end of life on 31 December 2026.
- Per PHP, all PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Risk is highest for mod_php.
- PHP 8.1 and older get no release from the PHP project. Its security team published minimal source backports for 7.4, 8.0, and 8.1.
- CloudLinux ea-php (cPanel EasyApache 4): fixed packages for ea-php52 through ea-php85 are released. Update, then restart Apache and PHP-FPM (step 3).
- CloudLinux alt-php: on CloudLinux 7, 8 and 9, the fixed packages are on their way to the CloudLinux stable repositories. Until they arrive, add the TuxCare ELS alt-php repository and update from it (step 3). On CloudLinux 10, a regular update installs every fixed version except alt-php 5.2, whose fix is being released to stable. On CloudLinux for Ubuntu 22.04, fixed alt-php 5.2, 5.6, 7.0 to 7.4, and 8.0 to 8.5 are in stable. CloudLinux 6 is not confirmed yet.
- Native PHP packages from the CloudLinux repositories (the operating system's own php packages, not alt-php or ea-php): fixed packages are in stable for PHP 8.2 and 8.3 on CloudLinux 9, and for PHP 8.2 on CloudLinux 8. Fixed builds for the other versions are in testing or early rollout, and not generally available yet.
- Imunify360 with the WAF enabled receives rulesets 8.83 to 8.85 automatically. On ModSecurity (Apache and Nginx) and Coraza, they block the known exploit requests and the public exploit tool. On LiteSpeed, ruleset 8.84 added blocking rules for the tool and for upload progress requests that don't come from the site's own pages. The rules target the upload progress path the public exploit uses, and no rule blocks the out-of-memory path of CVE-2026-109618 yet. This is an interim mitigation, not a fix.

For full details, commands, and the update history, please see our blog article: PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection
Posted Oct 22, 2026 - 00:52 UTC

Update

Update on fixed CloudLinux PHP packages for CVE-2026-109618 and CVE-2026-109619

Current status
- ea-php (cPanel EasyApache 4): fixed packages for ea-php52 through ea-php85 are released for CloudLinux OS 7, 8, 9 and 10.
- alt-php: on CloudLinux OS 7, 8 and 9, the fixed packages are on their way to the CloudLinux stable repositories. Until they reach the stable repository, fixed alt-php packages are available from the ELS ALT PHP repository (steps in the previous update). On CloudLinux OS 10, alt-php comes from the ELS ALT PHP repository; fixed alt-php 5.2 is being released to the stable repository. On CloudLinux OS for Ubuntu 22.04, fixed alt-php 5.2, 5.6, 7.0–7.4 and 8.0–8.5 are available in the stable repository.
- Native PHP (the operating system's own php packages, not alt-php or ea-php): fixed packages are in stable for PHP 8.2 and 8.3 on CloudLinux OS 9, and for PHP 8.2 on CloudLinux OS 8. Fixed builds for the other versions are in testing or early rollout.

How to update
ea-php (cPanel EasyApache 4):
CloudLinux OS 7: yum clean all && yum update "ea-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "ea-php*"
Then restart Apache and PHP-FPM:
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm

alt-php, where a fixed package is available:
CloudLinux OS 7: yum update 'alt-php*'
CloudLinux OS 8, 9, 10: dnf upgrade 'alt-php*'
CloudLinux OS for Ubuntu: apt-get update && apt-get upgrade

Native PHP: a regular package update installs the fixed packages; restart PHP-FPM or the web server afterwards.

How to confirm the fix
Our packages carry the fix as a backport, so their version numbers stay below PHP's (for example, ea-php84 is 8.4.26, not 8.4.27). Look for the CVE IDs in the package changelog instead:
rpm -q ea-php84-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'

Security advisory metadata (OVAL and UpdateInfo) is not published yet, so security-only updates such as yum --security do not list these packages. Use a regular update, as shown above.
Posted Oct 21, 2026 - 22:56 UTC

Update

Fixed alt-php packages for CloudLinux OS 7, 8, and 9 are available now in the ELS ALT PHP repository.
To install them, add the repository and update alt-php using the steps below. CloudLinux OS 10 already receives alt-php from this repository and only needs a regular update.

CloudLinux OS 7, 8 and 9
1. Make sure the server is registered with CLN (this file must exist):
ls /etc/sysconfig/rhn/jwt.token || rhnreg_ks --activationkey <YOUR-KEY> --force

2. CloudLinux OS 8, 9 only: make sure cloudlinux-release is recent enough to provide the ELS ALT PHP repository package (8.10-16 or newer on CloudLinux OS 8, 9.8-3 or newer on CloudLinux OS 9).
Otherwise, the next step fails with No match for argument: els-php-release.

Update it and check the version; the update may need to run more than once to reach the latest version:
dnf update -y cloudlinux-release
rpm -q cloudlinux-release

3. Add the ELS ALT PHP repository:
CloudLinux OS 7: yum install -y els-php-release
CloudLinux OS 8, 9: dnf install -y els-php-release

4. Keep regular updates working even if the repository becomes unreachable:
CloudLinux OS 7: yum-config-manager --save --setopt=php-els.skip_if_unavailable=true
CloudLinux OS 8, 9: dnf config-manager --save --setopt=php-els.skip_if_unavailable=True

5. Check access to the repository (the output must include "Metadata cache created"):
CloudLinux OS 7: yum --disablerepo='*' --enablerepo=php-els makecache
CloudLinux OS 8, 9: dnf --disablerepo='*' --enablerepo=php-els makecache

6. Update alt-php:
CloudLinux OS 7: yum update -y 'alt-php*'
CloudLinux OS 8, 9: dnf upgrade -y 'alt-php*'

CloudLinux OS 10
Run a regular update:
dnf upgrade -y 'alt-php*'

After updating, restart your PHP services (Apache, PHP-FPM or LiteSpeed).

To confirm a version is fixed, check its changelog (for example):
rpm -q --changelog alt-php82-common | grep -E 'CVE-2026-(109618|109619)'
Posted Oct 21, 2026 - 22:29 UTC

Update

Correction:
Our 19:00 UTC update said the first fixed CloudLinux alt-php packages were released.
Those packages went to the TuxCare ELS alt-php repository. CloudLinux 7, 8, and 9 servers install alt-php from the CloudLinux repositories, where the fixed packages are not available yet.

CloudLinux 10 servers install alt-php from the TuxCare ELS repository, and fixed alt-php 7.4 is confirmed there. Fixed ea-php packages for cPanel EasyApache 4, ea-php52 through ea-php85, are released. Imunify360 rulesets 8.84 and 8.85 add blocking rules, including on LiteSpeed.

Full details: https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619
Posted Oct 21, 2026 - 21:59 UTC

Update

Patched ea-php packages have been released to the stable repository for all versions from ea-php52 through ea-php85. Fixed versions (elX = el7, el8, el9 or el10):
- ea-php52: 5.2.17-27.elX.cloudlinux.67
- ea-php53: 5.3.29-29.elX.cloudlinux.69
- ea-php54: 5.4.45-82.elX.cloudlinux.9
- ea-php55: 5.5.38-64.elX.cloudlinux.10
- ea-php56: 5.6.40-25.elX.cloudlinux.18
- ea-php70: 7.0.33-29.elX.cloudlinux.17
- ea-php71: 7.1.33-20.elX.cloudlinux.17
- ea-php72: 7.2.34-12.elX.cloudlinux.18
- ea-php73: 7.3.33-15.elX.cloudlinux.18
- ea-php74: 7.4.33-18.elX.cloudlinux.13
- ea-php80: 8.0.30-11.elX.cloudlinux.1
- ea-php81: 8.1.34-4.elX.cloudlinux.1
- ea-php82: 8.2.34-2.elX.cloudlinux.1
- ea-php83: 8.3.35-2.elX.cloudlinux.2
- ea-php84: 8.4.26-2.elX.cloudlinux.1
- ea-php85: 8.5.11-2.elX.cloudlinux.1

To update, run:
yum clean all
yum update "ea-php*"
Then restart Apache and PHP-FPM:
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm

To confirm a version is fixed, check its PHP package, for example:
rpm -q ea-php71-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'
Posted Oct 21, 2026 - 20:55 UTC

Update

Fixed packages for the versions below are already available in our stable repositories. If you run any of them, please update now (a regular package update, e.g. `yum update alt-php*` / `apt upgrade`). Security advisory metadata (OVAL/VEX/UpdateInfo) will follow — until it is published, security-only update filters (`yum --security`, `dnf updateinfo`) will not list these packages.

ALT-PHP — fixed versions available now
• CloudLinux / AlmaLinux 8, 9: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux / AlmaLinux 10: 5.6, 7.4, 8.4
• CloudLinux 7: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux 6: 5.2, 5.6, 7.4, 8.0
• Ubuntu 18.04, 20.04, 22.04, 24.04: 5.2, 5.6, 7.4, 8.4
• Ubuntu 26.04: 5.6, 7.4, 8.4 · Ubuntu 16.04: 5.6, 7.4
• Debian 10, 11: 5.6, 7.4, 8.0, 8.4
• Debian 12: 5.6, 7.4, 8.0, 8.1, 8.3, 8.4
• Debian 13: 5.2–5.6, 7.4, 8.0, 8.1, 8.3, 8.4
• Alpine 3.23, 3.24: 7.3, 8.0, 8.1
Remaining alt-php versions are rolling out continuously; the bulk is expected by ~21:15 UTC, alt-php 8.5 by ~22:30 UTC.

TuxCare ELS / ESU — distribution PHP fixed and available now
RHEL 7, Oracle Linux 6 and 7, CentOS 8.4, CentOS 8.5, CentOS Stream 8, Amazon Linux 2, AlmaLinux 9.2 ESU, AlmaLinux 9.8 ESU, TuxCare 9.6 ESU, TuxCare 9.8 ESU, Ubuntu 16.04 / 18.04 / 20.04 ELS, Alpine 3.18 ELS
Releasing now: CloudLinux 7, Debian 11 ELS
Next: CentOS 6, CentOS 7, Debian 10 ELS, PHP for Windows

Interim protection: Imunify360 ModSecurity ruleset 8.84 (stable) blocks the known exploit pattern; servers with Imunify360 WAF enabled receive it automatically.

We will post an update every 30 minutes until all packages are released.
Posted Oct 21, 2026 - 20:18 UTC

Update

New fixed packages have been released:

- alt-php80 for EL 7, EL 8
- php-8.0.30 for AlmaLinux 9.2 ESU
Posted Oct 21, 2026 - 18:22 UTC

Update

Update – Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619): WAF protection in place

The following protections were rolled out on Oct 21 (all times UTC):

- WAF ruleset 8.83 (09:08): blocks the known exploit request pattern and adds detection of exploit attempts.

- WAF ruleset 8.84 (13:07): blocks the publicly available exploit tool and additional exploit request patterns.

- WAF ruleset 8.85 (17:17): blocks further variants of the exploit tool and adds detection of related malformed upload requests.

- IP reputation (updated continuously): IP addresses that scan for or exploit these vulnerabilities get a CAPTCHA challenge on servers protected by Imunify360.

Rulesets are delivered automatically; no action is required. We still recommend updating PHP to a patched version as soon as one is available for your environment.
Posted Oct 21, 2026 - 17:38 UTC

Update

New fixed packages have been released:
- alt-php74 for EL9, Ubuntu 20.04
- alt-php80 for EL 6, Alpine Linux 3.24, Debian 10, Debian 11
- alt-php81 for Alpine Linux 3.23, Alpine Linux 3.24
- php-8.0.30 for TuxCare 9.6 ESU
Posted Oct 21, 2026 - 17:29 UTC

Update

New fixed packages have been released:
- php-7.4.6 for CentOS 8.4 ELS
- php-7.0.33 for Ubuntu 16.04 ELS
- php-7.2.24-0 for Ubuntu 18.04 ELS
- alt-php80 for Alpine Linux 3.23
Posted Oct 21, 2026 - 16:46 UTC

Update

Fixed alt-php74 are released for EL 8, Debian 11, Ubuntu 16.04, Ubuntu 24.04 and Ubuntu 26.04

Fixed php-7.4.19 released for CentOS 8.5 ELS
Posted Oct 21, 2026 - 16:08 UTC

Update

Fixed alt-php74 is already released for EL6, EL7, EL10, Debian 10, Ubuntu 18.04 and Ubuntu 22.04
Posted Oct 21, 2026 - 15:36 UTC

Update

Critical PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619): updates in progress

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical vulnerabilities (CVSS 9.2) that allow unauthenticated remote code execution:

- CVE-2026-109618: memory corruption when PHP runs out of memory while handling specially crafted multipart (form or upload) requests.

- CVE-2026-109619: internal data left over from an earlier request can be reused after its memory is freed, for example through session upload progress handling.

Apache mod_php carries the highest risk. PHP-FPM, LiteSpeed and FrankenPHP are affected in some configurations.

What we're doing:
- CloudLinux alt-php: We are preparing patched builds for all alt-php versions, from 5.2 through 8.5. We expect to release them within approximately 5 hours. We will update this page when they are available.
- cPanel ea-php: Patched ea-php74 through ea-php85 packages are scheduled for release in EasyApache4 v25.91.
- TuxCare ELS: Patched PHP packages for supported ELS operating systems are in testing and will be released as they complete validation.
- Imunify360: WAF rules that detect attempts to exploit these vulnerabilities have been deployed.

What you should do:
- Apply PHP updates as soon as they are available (yum update / apt upgrade) and restart your PHP services: Apache, PHP-FPM or LSAPI.
- Until then, you can reduce (but not remove) the risk by setting session.upload_progress.enabled=0 in php.ini or the FPM pool configuration, then restarting PHP.

We will post updates here as packages are published.
Posted Oct 21, 2026 - 14:55 UTC

Identified

The releases for alt-php are already in progress. The ea-php is also proceeding to release soon
We plan to release fixes for alt-php and ea-php by 19:00 UTC. Maximum effort is currently being made to get this done sooner.

alt-php74 is already released for EL6 and EL10
Posted Oct 21, 2026 - 14:39 UTC

Update

The Imunify360 ModSecurity ruleset 8.83 is now in the Stable channel. It contains a blocking rule for the publicly circulating exploit shape for CVE-2026-109618 / CVE-2026-109619, which targets the PHP session upload progress handling of multipart requests, plus a telemetry rule to track related activity. Servers with Imunify360 and its WAF (ModSecurity) enabled receive the ruleset automatically, no action is needed. Attempts matching this pattern are already being observed, and additional heuristic rules are being prepared.

This is an interim mitigation, not a complete fix: the underlying issue is broader than the multipart upload path. The PHP security release is still scheduled for today, 21 October 2026, 14:00 UTC. Work on updated alt-php packages with the fix is in progress, we will share the timeline in the next update.

Optional partial hardening until the patch is applied: disabling the session upload progress feature in php.ini (session.upload_progress.enabled = Off). This closes only one of the known paths and does not fully mitigate the vulnerability. Applications that display upload progress bars via this feature will lose that functionality.
Posted Oct 21, 2026 - 09:26 UTC

Investigating

The PHP Security Team has announced an upcoming security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical).
Technical details and affected versions are scheduled to be disclosed at that time.

We will post updates here as more information becomes available.

Official announcement:
https://www.php.net/archive/2026.php#2026-10-20-1
Posted Oct 20, 2026 - 21:00 UTC
This incident affects: CloudLinux OS Components (Alt-PHP).
← Current Status Powered by Atlassian Statuspage