The PHP project released security updates on 21 October 2026 fixing two critical, unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated CVSS 9.2. If you run a self-managed (unmanaged) cloud or VPS server, or a dedicated server, with PHP installed, you are responsible for updating it yourself.
Update to:
- PHP 8.5.x → 8.5.12
- PHP 8.4.x → 8.4.27
- PHP 8.3.x → 8.3.36
- PHP 8.2.x → 8.2.35
Check your current version with:
php -v
On a cPanel server with EasyApache PHP, update through WHM's MultiPHP Manager. If you run multiple PHP versions for different sites, check each one.
If you're on an Ucartz managed plan (Managed cPanel VPS, Managed Webmin VPS, Managed CWP VPS or another fully managed service), there's nothing you need to do. PHP and system patching is part of the service, and our team applies vendor security updates like this one as part of normal maintenance.
If you run a self-managed KVM VPS or an unmanaged dedicated server, PHP patching is on you, the same as any other software you install.
We've written up the full details, including what the vulnerabilities actually do, how to check each PHP version, and a single check-and-update command for the most common setups, on our blog: Critical PHP Security Update: What You Must Do.
If you're not sure which plan you're on, or whether patching is included for your service, open a Technical Support ticket and we'll confirm.
For just the commands, no background reading: How to Fix the Critical PHP Security Vulnerabilities in our knowledge base.
Source: the PHP project's official 21 October 2026 security release announcement.
