Major PHP patch issued today

T

TomBrown

New Member
21 Oct 2026

Security advisory: Critical remote code execution vulnerabilities, update now​


PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The vulnerabilities:

  • RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
  • RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
How to update:

  • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Source downloads are on our downloads page. Windows source and binaries are on the same page.
  • Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.
  • PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.
 
Below is the only message I've seen from KnownHost (shown before submitting a ticket) and it was several hours ago. I still have yet to receive or find any updates from KH about it since then.

Can we get an update from the KH powers that be? Sounds like a pretty major issue.

Here is the message (Wed morning):

Security Notice: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

We’re aware of two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and our team is actively monitoring the situation. We’re currently waiting on the various vendors to release patched versions, and as soon as they’re available we’ll be applying them to all managed customers. There’s no need to open a ticket to request the update, as it will be handled for you.

Because of the scale of this issue, our support team is under an extremely heavy workload right now. We kindly ask that you hold off on any non-critical tickets or issues until things settle down, which will help us focus on getting everyone protected as quickly as possible.

Thank you for your patience and understanding. We truly appreciate it.

The KnownHost Team
 
I haven't received *any* communications from KnownHost regarding this issue. However, I did take the step of updating to PHP Version 8.4.27 this morning on my VPS.
 
Howdy,

Apologies we've been a bit busy rolling out updates. All managed systems are either updated, or in the process of receiving updates based on vendor availability.

Some vendors are shipping faster than others, but we're all hands on deck making sure everything is sorted.
 
KH-DanielP said:
Howdy,

Apologies we've been a bit busy rolling out updates. All managed systems are either updated, or in the process of receiving updates based on vendor availability.

Some vendors are shipping faster than others, but we're all hands on deck making sure everything is sorted.
Click to expand...

Does this include dedicated servers too? Wasn't sure if that fell under your "managed systems" umbrella. I want to make sure my dedicated server gets those patches as well. Thanks for the update!
 
Will all these updates be automatic and forced? I'd be okay with that, if things break, I'd rather deal with that than deal with hack
 
LighthouseWD said:
Does this include dedicated servers too? Wasn't sure if that fell under your "managed systems" umbrella. I want to make sure my dedicated server gets those patches as well. Thanks for the update!
Click to expand...
As long as you have managed services with us yes, it does include dedicated servers.
 
digitalsmokes said:
Will all these updates be automatic and forced? I'd be okay with that, if things break, I'd rather deal with that than deal with hack
Click to expand...
We will force the minor php version update yes, but if you're running an outdated OS, or older php that's not got backported fixes we will not force remove it no.
 
One of my WP sites on shared had a brief outage at 1:34pm PT today and came up a few minutes later, so I had a feeling updates were in progress (Daniel's message reinforces that).

The cPanel EasyApache 4 security release identifies PHP 8.2.35 and 8.3.36 as the patched versions.

My shell reports:
$ php -v
PHP 8.2.34 (cli) (built: Oct 21 2026 16:18:45) (NTS)

The version (granted, cli) is one minor rev behind, but hopefully the fact that it was updated today means that the fixes have been applied. I ran a script on my account that indicates "8.2.34 litespeed" for PHP_VERSION and PHP_SAPI, so a confirmation that the fixes have been applied despite the version numbers not matching what is expected from cPanel would be awesome.
 
haus said:
One of my WP sites on shared had a brief outage at 1:34pm PT today and came up a few minutes later, so I had a feeling updates were in progress (Daniel's message reinforces that).

The cPanel EasyApache 4 security release identifies PHP 8.2.35 and 8.3.36 as the patched versions.

My shell reports:
$ php -v
PHP 8.2.34 (cli) (built: Oct 21 2026 16:18:45) (NTS)

The version (granted, cli) is one minor rev behind, but hopefully the fact that it was updated today means that the fixes have been applied. I ran a script on my account that indicates "8.2.34 litespeed" for PHP_VERSION and PHP_SAPI, so a confirmation that the fixes have been applied despite the version numbers not matching what is expected from cPanel would be awesome.
Click to expand...
Updates on the shared platforms are in progress but they also had extra protection from the i360 WAF that's installed.
 
Hi, any updates on us DirectAdmin control panel users? According to DirectAdmin, they have added the patches, but running 'da update' and then 'da build php' generates build errors
 
We're on a shared plan, still showing no patch at 7pm. I know that some servers had the patch installed before noon today.
 
waiheke5 said:
Hi, any updates on us DirectAdmin control panel users? According to DirectAdmin, they have added the patches, but running 'da update' and then 'da build php' generates build errors
Click to expand...

For DA we're continuing to roll out the updates, but since it compiles by source that takes quite a while to execute. If your system runs into issues a common problem we've found is left over files in /usr/local/directadmin/custombuild/custom/php/ , i.e. configure.php74 , you can rename that file to configure.php74.old and rebuild php.

Alternatively we will get to your system as we continue to work them or you may open a ticket.
 
pk-atl said:
We're on a shared plan, still showing no patch at 7pm. I know that some servers had the patch installed before noon today.
Click to expand...
Howdy,

Our shared systems utilize cloudlinux PHP which did release later this afternoon. One thing to note is that CL backports the fixes, and does not always increment the version number.

So below is a list of patched cloudlinux php versions


Code: 
- ea-php52: 5.2.17-27.elX.cloudlinux.67
- ea-php53: 5.3.29-29.elX.cloudlinux.69
- ea-php54: 5.4.45-82.elX.cloudlinux.9
- ea-php55: 5.5.38-64.elX.cloudlinux.10
- ea-php56: 5.6.40-25.elX.cloudlinux.18
- ea-php70: 7.0.33-29.elX.cloudlinux.17
- ea-php71: 7.1.33-20.elX.cloudlinux.17
- ea-php72: 7.2.34-12.elX.cloudlinux.18
- ea-php73: 7.3.33-15.elX.cloudlinux.18
- ea-php74: 7.4.33-18.elX.cloudlinux.13
- ea-php80: 8.0.30-11.elX.cloudlinux.1
- ea-php81: 8.1.34-4.elX.cloudlinux.1
- ea-php82: 8.2.34-2.elX.cloudlinux.1
- ea-php83: 8.3.35-2.elX.cloudlinux.2
- ea-php84: 8.4.26-2.elX.cloudlinux.1
- ea-php85: 8.5.11-2.elX.cloudlinux.1
 
KH-DanielP said:
Howdy,

Our shared systems utilize cloudlinux PHP which did release later this afternoon. One thing to note is that CL backports the fixes, and does not always increment the version number.

So below is a list of patched cloudlinux php versions


Code: 
- ea-php52: 5.2.17-27.elX.cloudlinux.67
- ea-php53: 5.3.29-29.elX.cloudlinux.69
- ea-php54: 5.4.45-82.elX.cloudlinux.9
- ea-php55: 5.5.38-64.elX.cloudlinux.10
- ea-php56: 5.6.40-25.elX.cloudlinux.18
- ea-php70: 7.0.33-29.elX.cloudlinux.17
- ea-php71: 7.1.33-20.elX.cloudlinux.17
- ea-php72: 7.2.34-12.elX.cloudlinux.18
- ea-php73: 7.3.33-15.elX.cloudlinux.18
- ea-php74: 7.4.33-18.elX.cloudlinux.13
- ea-php80: 8.0.30-11.elX.cloudlinux.1
- ea-php81: 8.1.34-4.elX.cloudlinux.1
- ea-php82: 8.2.34-2.elX.cloudlinux.1
- ea-php83: 8.3.35-2.elX.cloudlinux.2
- ea-php84: 8.4.26-2.elX.cloudlinux.1
- ea-php85: 8.5.11-2.elX.cloudlinux.1
Click to expand...
Daniel,
thank you for that information! I can see that although phpinfo() still shows 8.2.34, running "php -v" in a terminal does show a build date of this afternoon. Looks like we should be good.

Thanks,
PK
 
Reseller here (Sorry, I couldn't find any other reference to the vulnerability from KnownHost except in this VPS/Dedicated thread).... Our WP sites on Reseller servers are still showing vulnerable versions - any word on when they will be patched?
 
I have a shared hosting servers and have a couple of questions.

Should unsupported PHP versions be uninstalled?
If one user is still using and unsupported version, does it put the entire server at risk?

Thanks!
 
smitty-kh said:
Reseller here (Sorry, I couldn't find any other reference to the vulnerability from KnownHost except in this VPS/Dedicated thread).... Our WP sites on Reseller servers are still showing vulnerable versions - any word on when they will be patched?
Click to expand...
Hi Smitty,

Everything was patched as of yesterday. We utilize cloudlinux repositories which backported the fix, but did not increment the version number. Rest assured everything is squared away.
 
Eahrenee said:
I have a shared hosting servers and have a couple of questions.

Should unsupported PHP versions be uninstalled?
If one user is still using and unsupported version, does it put the entire server at risk?

Thanks!
Click to expand...
Howdy,

So there's a big "It Depends"

cPanel for example only officially patched version 7.4 and newer, DirectAdmin released patches for 5.6 and up, and cloudlinux has patched all versions.

So, if you're default cpanel and no imunify/cloudlinux I'd say it wouldn't hurt to remove anything 7.3 or older.

In general its a good practice to remove things that aren't needed anymore, it keeps updates/maintenance simpler for a server but if you're running alt or hardened PHP from Imunify/Cloudlinux then you have less to worry about there.
 
KH-DanielP said:
Howdy,

So there's a big "It Depends"

cPanel for example only officially patched version 7.4 and newer, DirectAdmin released patches for 5.6 and up, and cloudlinux has patched all versions.

So, if you're default cpanel and no imunify/cloudlinux I'd say it wouldn't hurt to remove anything 7.3 or older.

In general its a good practice to remove things that aren't needed anymore, it keeps updates/maintenance simpler for a server but if you're running alt or hardened PHP from Imunify/Cloudlinux then you have less to worry about there.
Click to expand...

Thanks for the information.
I am using Cpanel, and didn't realize they offered a patch for 7.4 - 7.1.

It was my understanding that anything older than 8.2 would be vulnerable. I guess this helps calm the fire a little.
Thanks!
 
You must log in or register to reply here.
Top