Critical Security Advisory: PHP Releases Emergency Patch for Remote Code Execution (RCE) Vulnerabilities

At HostPapa, the security, performance, and reliability of your online presence are our top priorities. The official PHP development team recently issued an emergency security advisory regarding two critical vulnerabilities—CVE-2026-109618 & CVE-2026-109619—affecting web applications running on PHP across the internet.

Because these vulnerabilities allow unauthenticated Remote Code Execution (RCE) under specific conditions, our technical infrastructure team immediately initiated fleet-wide mitigation and patching procedures.

Here is a full breakdown of what these vulnerabilities entail, what actions HostPapa has completed on your behalf, and the steps required if you manage your own server environment.

Understanding the Vulnerability: What Happened?

The advisory concerns two unauthenticated Remote Code Execution flaws in PHP’s core processing engine:

• Remote Code Execution (RCE): An attacker can send specially crafted network requests to execute unauthorized system commands or arbitrary code on a vulnerable server without needing login credentials.
• Scope of Exposure: While these vulnerabilities target core components of PHP, the practical exploitability depends heavily on the PHP runtime version, operating system environment, and web server configuration.

Because remote code execution carries a high severity rating, immediate patching of the PHP binary and runtime libraries is critical to prevent automated exploits across the wider web.

What HostPapa Has Done: Fleet-Wide Mitigation

Our engineering and systems operations teams deployed updates across our managed infrastructure as soon as upstream vendor patches became available:

Environments Requiring Customer Action

While our automated and managed operations protect the vast majority of our fleet, certain dedicated and custom hosting configurations have operational boundaries that prevent automated patching.

If you manage any of the following setups, your direct action is required:

1. Unmanaged VPS & Unmanaged Dedicated Servers:
   Because root-level administration belongs solely to you, HostPapa does not modify your operating system packages, PHP binaries, or configuration files.
2. Managed Servers Running CentOS 7 (End-of-Life):
   CentOS 7 reached official End-of-Life (EOL) and no longer receives upstream operating system security updates. If an OS elevation or migration was previously declined, automated security tools cannot compile or apply the necessary fixes.
3. Managed Servers with Restricted Administrative Access:
   If our team’s standard administrative access has been restricted (e.g., custom SSH port reassignments, IP-restricted firewalls, or modified root keys without notifying support), our automated maintenance pipelines could not apply the update.

Technical Breakdown: Version & Platform Matrix

Upstream patch availability varies depending on your server’s underlying operating system and PHP handler:

• Official PHP Team (Upstream): Fixed natively in PHP versions 8.2 through 8.5.
• cPanel (EasyApache / ea-php): cPanel has issued backported security patches for ea-php versions 7.4, 8.0, and 8.1.
• CloudLinux (alt-php / PHP Selector): CloudLinux has published backported patches for every alt-php version.
• Unsupported Configurations:
• Running PHP 7.3 or older on a standard cPanel server without CloudLinux will not receive a vendor fix.
• Any PHP installation running on CentOS 7 will not receive an official OS-level fix.

Crucial Takeaway: If your unmanaged or custom server runs PHP 7.3 or older without CloudLinux, or operates on CentOS 7, your environment cannot be patched in place. Upgrading your PHP version or performing a full operating system migration is urgently required.

Recommended Action Plan for Server Administrators

If you are responsible for an unmanaged VPS, dedicated server, or custom environment, follow these steps immediately:

1. Audit Your Current PHP Versions

Check your active PHP handlers and versions either via WHM/cPanel or via terminal:

# Check CLI PHP version

php -v

# On cPanel servers, list installed EasyApache PHP packages

rpm -qa | grep -E "ea-php|alt-php"

2. Apply cPanel / EasyApache Updates

If your server runs cPanel with ea-php:

yum clean all && yum update ea-php* -y

# Or on AlmaLinux / Rocky Linux:

dnf clean all && dnf upgrade ea-php* -y

3. Transition Away from Legacy PHP (7.3 and Older)

If your applications rely on PHP 7.3 or earlier and you do not run CloudLinux:

• Audit your site code, themes, and plugins for compatibility with PHP 8.1+.
• Switch your active PHP version in cPanel via MultiPHP Manager.

4. Upgrade Outdated Operating Systems (CentOS 7)

Because CentOS 7 has reached its End-of-Life, running production workloads on it presents mounting compliance and security risks. We strongly recommend migrating to a modern, supported distribution such as AlmaLinux 8 or 9.

We Are Here to Help

Security is an ongoing, shared responsibility. If you have an unmanaged server and would like assistance migrating to a fully managed HostPapa plan, or if you need our team to help schedule an operating system elevation to AlmaLinux, we are ready to assist.

• Submit a Ticket: Open a ticket via your HostPapa Dashboard.
• Live Chat & Phone: Speak directly with our PapaSquad technical support team 24/7/365.
• Knowledge Base: Visit our Knowledge Base for step-by-step guides on managing PHP versions and server security.