We have applied the security updates for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 on all our shared hosting servers and on managed VPS/dedicated servers. The update covers both types of PHP versions available in your account (where present): the cPanel versions (ea-php) and the PHP Selector versions (alt-php). No action is required on your part.
A note on version numbers: our OS vendor, CloudLinux, ships security fixes as backports, meaning the patch is applied to the existing version. Because of this, the PHP version shown may be lower than the official php.net release (for example, PHP 8.4.26 instead of 8.4.27) even though the fix is in place. If a security scanner flags your PHP version as vulnerable based on the version number alone, it is most likely a false positive.
The fix can be verified by the server administrator (root access via SSH):
