PHP2Shell: cPanel publishes exact WHM and EasyApache versions to install
cPanel lists precise builds of WHM, EasyApache 4 and WP Squared that fix CVE-2026-109618 and -109619, plus mitigation to maintain even after patching.
UptimeMag editorial team · 26 October 2026 · 2 min read
cPanel published on 26 October 2026 on its blog a list of builds of its products that fix the two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with CVSS v4.0 9.2. System administrators managing servers with cPanel & WHM can find here the version numbers to verify, not just the generic announcement already circulating.
The patched PHP versions
On 21 October 2026, PHP released corrected versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618 and CVE-2026-109619. According to SanSec, the vulnerable code for CVE-2026-109618 has been present since PHP 5.4.0, released in 2012.
The cPanel builds to verify
| Product | Corrected version | Date |
|---|---|---|
| EasyApache 4 | v25.91: ea-php82, ea-php83, ea-php84, ea-php85 updated to 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 21 October 2026 |
| EasyApache 4 | v25.92: ea-php74-meta, ea-php80-meta, ea-php81-meta with PHP backport | 21 October 2026 |
| cPanel & WHM | 11.138.0.18, 11.136.0.50, 11.134.0.66, 11.110.0.153 (internal PHP in cpanel-php84 8.4.27, cpanel-php81 8.1.34-2 on 110) | security releases |
| WP Squared | 11.138.1.18, with updated WP Toolkit | security releases |
Those staying on PHP 7.4, 8.0 or 8.1 under EasyApache 4 are still covered by the PHP project's backport, whilst builds for PHP 7.3 and earlier have not received fixes. For those who must remain on EOL PHP versions, cPanel offers Extended Lifecycle Support for PHP for purchase.
Mitigation not to remove
Even after updating, cPanel notes that on 23 October 2026 the PHP project recommended maintaining session.upload_progress.enabled=0 until the next regular bugfix release, because this reduces exposure to a third related flaw, CVE-2026-115560. In WHM the parameter is set via the MultiPHP INI Editor.
What to do immediately
- Restart PHP-FPM, Apache and every PHP worker after updating: package installation alone is not sufficient.
- Check third-party repositories: not all had corrected packages on the release date.
- Verify arm64 builds too, published in some repositories after the amd64 ones.
- Rebuild container images, CI runners and internal tools that embed PHP, not just production servers.
For up-to-date details, cPanel refers to the dedicated support article, which is continuously updated as new packages are released.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50). Source: cPanel – blog.