PHP Security Vulnerability Assessment (CVE-2026-109618 & CVE-2026-109619)

Our Engineering teams are actively working to deploy patched PHP builds across our hosting infrastructure.

The current patched PHP builds are:

cPanel
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
PHP 8.1.34-5 (Vendor backport)
PHP 8.0.30-12 (Vendor backport)
PHP 7.4.33-19 (Vendor backport)


Plesk (v18.0.81.4)
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
PHP 8.1 (EOL) 7.4.33 (built on 21 Oct 2026)
PHP 8.0 (EOL) 77.4.33 (built on 21 Oct 2026)
PHP 7.4 (EOL) 7.4.33 (built on 21 Oct 2026)

Windows Plesk
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35


To verify that your site is patched, please follow this Help Article: https://www.liquidweb.com/help-docs/performance/website-optimization/how-to-use-a-phpinfo-file/

If you are not currently patched, please try running a package update through your control panel. If your site is running an unsupported/EOL version of PHP, please update your code to work on a Supported version, and switch to that as soon as possible.

We will continue to provide status updates, and we will be emailing individuals tailored information as best we can.

Our Security and Engineering teams are continuing to evaluate the optimal patching strategy for our hosting environments.

Customers using cPanel/WHM can patch PHP Versions 8.5, 8.4, 8.3, 8.2, along with the backported versions 8.1, 8.0 and 7.4
by performing a cPanel update and the running a yum update.

Our infrastructure remains under heightened monitoring, and we will share further details here as soon as our deployment plan and maintenance windows are finalized.

If you need assistance or have any concerns, please contact our Support team.

Our Security and Engineering teams are continuing to evaluate the optimal patching strategy for our hosting environments.

We are currently analyzing the security releases and testing deployment paths in our staging environments to ensure service stability. At this time, no patches or modifications have been rolled out to production systems.

Our infrastructure remains under heightened monitoring, and we will share further details here as soon as our deployment plan and maintenance windows are finalized.

If you need assistance or have any concerns, please contact our Support team.

We are aware of recent reports regarding two critical vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities may affect web servers running PHP 5.4 and later and could potentially allow remote code execution.

Our Security and Engineering teams are actively reviewing our hosting environments to assess potential impact. As a precautionary measure, we are implementing appropriate mitigations and working to deploy the necessary security updates across affected systems as they become available.

We are continuing to closely monitor the situation and will provide further updates as additional information becomes available.

If you need assistance or have any concerns, please contact our Support team.