PHP CVE-2026-109618 and -109619: CloudLinux packages and Imunify360 shield

On 21 October 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Those running hosting on CloudLinux need to know that the vendor's packages do not immediately follow the same version numbers: the fix arrives as a backport, so confirmation should be made against the changelog, not the release number.

What the two flaws affect

CVE-2026-109618 is a memory corruption that triggers when PHP runs out of available memory during a request. CVE-2026-109619 is a use-after-free: residual state from a previous request remains accessible and a reused worker treats it as valid. According to CloudLinux, all installations serving web requests are affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk on mod_php. To illustrate the scope, Palo Alto Networks Unit 42 has identified over 22.6 million potentially vulnerable instances based on their telemetry, whilst watchTowr has reported observing active exploitation through their Attacker Eye honeypot network.

CloudLinux package status

For EasyApache4 (ea-php), corrected packages from ea-php52 to ea-php85 are already in stable for CloudLinux 7, 8, 9 and 10. To update:

dnf clean all && dnf upgrade "ea-php*"
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm

For alt-php on CloudLinux 7, 8 and 9, corrected packages are in transit to stable repositories: in the meantime, pull them from the TuxCare ELS ALT PHP repository (dnf install -y els-php-release, then dnf upgrade -y 'alt-php*'). On CloudLinux 10, a normal update installs all corrected versions except alt-php 5.2, which is still in release. For native OS PHP packages (neither alt-php nor ea-php), corrected builds are in stable only for PHP 8.2 and 8.3 on CloudLinux 9 and PHP 8.2 on CloudLinux 8; other versions are still in testing. To verify the fix, given that version numbers remain lower than official PHP releases, check the package changelog:

rpm -q ea-php84-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'

Imunify360 mitigation is not a patch

Those with the Imunify360 WAF active automatically receive rulesets 8.83, 8.84 and 8.85, which block known exploit requests and the public attack tool, including on LiteSpeed. CloudLinux clarifies that this is temporary mitigation: no rule yet blocks the memory exhaustion path of CVE-2026-109618. PHP update remains the only definitive fix. It is also worth noting that PHP 8.2 reaches end of life on 31 December 2026, after which it will no longer receive security patches.