Updated: 22 October 2026 · Applies to: PHP 8.2, 8.3, 8.4 and 8.5 on cPanel, Ubuntu, Debian, AlmaLinux and Rocky
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, whichever major version you run. These releases fix two critical, unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that the PHP project published on 21 October 2026.
1. Check your current version
Run this on your server's command line:
php -v
If you run multiple PHP versions for different sites, check each one. On a cPanel server, your active version's binary is under /opt/cpanel/ea-phpXX/root/usr/bin/php (for example ea-php83 for PHP 8.3).
2. Update with a single command
Each of these checks your version and updates PHP through your system's own package manager in one line. If you're already on a current, patched version, the update step changes nothing.
cPanel with EasyApache PHP, on AlmaLinux or CloudLinux:
php -v && yum update -y "ea-php*"
cPanel with EasyApache PHP, on Ubuntu:
php -v && apt update && apt install --only-upgrade -y "ea-php*"
Plain Ubuntu or Debian, PHP from your distribution's repositories or the Ondrej Sury PPA:
php -v && apt update && apt install --only-upgrade -y php-common php-cli php-fpm
AlmaLinux, Rocky or another RHEL-family server, PHP from the Remi repository:
php -v && dnf update -y "php*"
3. Confirm the update
Run php -v again and check the version number against the table below.
| Your branch | Update to |
|---|---|
| PHP 8.5.x | 8.5.12 |
| PHP 8.4.x | 8.4.27 |
| PHP 8.3.x | 8.3.36 |
| PHP 8.2.x | 8.2.35 |
PHP 8.1 and older no longer receive official updates from the PHP project. If you're on an end of life branch, treat this as a reason to plan an upgrade to a supported version.
Why this matters
Both vulnerabilities are rated CVSS 9.2 (critical) and can let an attacker run arbitrary code on an affected server without logging in first. CVE-2026-109618 involves memory handling under out of memory conditions on mod_php setups. CVE-2026-109619 involves internal request state that can survive and be reused by a later request on the same worker process. According to PHP's advisory, updating is the only complete fix: settings like a lower post_max_size or disabling session.upload_progress.enabled only reduce exposure to specific attack paths.
Who needs to do this
If you're on one of our fully managed plans (Managed cPanel VPS, Managed Webmin VPS, Managed CWP VPS or another fully managed service), our team applies this update for you as part of normal maintenance, there's nothing you need to do. If you run a self-managed KVM VPS or an unmanaged dedicated server, PHP patching is your responsibility, the same as any other software you install.
For the full background on these vulnerabilities, see our blog post Critical PHP Security Update: What You Must Do. If you're not sure which plan you're on or whether patching is included, open a Technical Support ticket and we'll confirm.
Still on CentOS 7? It's end of life and cannot run any of the fixed PHP versions: see installing PHP on AlmaLinux/Rocky 9 or installing PHP 8 on AlmaLinux/RHEL 9 to move off it first.
Official documentation: the PHP project's 21 October 2026 security release announcement.
