PHP security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)

Comments

• Saragoldfarb Veteran, Megathread Squad

  9:59PM

  The world didn't end. I think we're good.

  Thanked by 2HostDZire tarisu
• tarisu Member, Host Rep

  10:11PM

  Did virtualizor patched the issue?
• dustinc Patron Provider, Top Host, Veteran

  11:08PM

  As a heads up - unlike a traditional PHP update, CloudLinux backported the fix into its php packages. This means the version number may be below PHP's, despite being patched.

  How to confirm the fix

  Our packages carry the fix as a backport, so their version numbers stay below PHP's (for example, ea-php84 is 8.4.26, not 8.4.27). Look for the CVE IDs in the package changelog instead:
  rpm -q ea-php84-php-cli --changelog | grep -E "CVE-2026-(109618|109619)"
• dustinc Patron Provider, Top Host, Veteran

  11:13PM

  @tarisu said:
  Did virtualizor patched the issue?

  We do not use Virtualizor - but yes, it appears that Virtualizor emps was updated a few hours ago (still uses php 7.4, but includes the backport fixes for PHP2Shell): https://www.virtualizor.com/blog/virtualizor-3-3-0-launched-patch-5/