G’day,

Please be aware of forthcoming critical security updates for PHP which will be applied with haste.

• CVE-2026-109618
• CVE-2026-109619
• https://www.php.net/archive/2026.php#2026-10-20-1

We’re working with upstreams (CloudLinux, DirectAdmin, Media Control Panel, etc) to ensure prompt updates:

• CloudLinux: #296705
• DirectAdmin: #73089
• MediaCP: #IQM-34518

The updates patch 2x CVSS 4.0 critical (9.2) rated vulnerabilities. It seems that PHP5, 7 & 8 (released 2004-2026) are impacted. PHP intends to release the updates at midnight Sydney time. Downstream will follow that.

“The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP.”

Further updates will be provided as they come to light, and as we deploy updates globally.

Cheers,
Merlot Digital