The PHP Development Team has released security updates addressing two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

Official PHP advisory: https://www.php.net/archive/2026.php

At HostRainbow, we took this issue seriously from the moment we identified it. We monitored the official PHP security release, prioritised the required work, and began applying the available vendor security fixes on behalf of our shared hosting customers as soon as they became available.

We also rechecked the installed package changelogs and available patch information on the morning of 22 October.

1. Shared Hosting & Reseller Hosting Customers: No Action Required

If you use HostRainbow Shared Hosting or Reseller Hosting:

• Status: Security updates have been applied to the PHP packages covered by our update process.

• Action Required: No manual PHP update is required from you for the updates handled by HostRainbow.

• What we did: We monitored the official release, applied available security fixes, and checked the package patch information again the following morning.

You can continue managing your websites as usual. Please keep your website applications, themes and plugins updated as well.

2. VPS & Dedicated Server Customers: Please Check Your Server

If you use a self-managed or unmanaged VPS or dedicated server, you are responsible for maintaining its operating system, control panel and PHP installations unless a separate management service covers this work.

Please check and install the applicable security updates on all your PHP-enabled servers, including servers hosted with other providers.

cPanel / WHM with EasyApache 4

Run as root:

dnf update 'ea-php*'

Review the packages and confirm the update. Use the package manager appropriate to your operating system if it differs.

CloudLinux ALT-PHP

Run as root:

dnf update 'alt-php*'

If you use CloudLinux PHP Selector, verify that the relevant ALT-PHP packages have received the vendor's fixes.

DirectAdmin

DirectAdmin servers using CustomBuild should check the available PHP updates and the vendor's patch status. Update or rebuild the configured PHP versions using the appropriate CustomBuild procedure.

Other Linux servers

For AlmaLinux, Rocky Linux, RHEL, Debian or Ubuntu, use the security updates supplied by your operating system and PHP package provider. Do not assume that updating one PHP version updates every installed version.

3. Verify the Security Fixes

For cPanel EasyApache 4, you can check package changelogs for the two CVE identifiers:

for p in $(rpm -qa 'ea-php*-php-common' | sort); do
  echo "== $p"
  rpm -q --changelog "$p" | grep -iE 'CVE-2026-10961[89]' || echo "No CVE entry found"
done

For CloudLinux ALT-PHP:

for p in $(rpm -qa 'alt-php*-common' | sort); do
  echo "== $p"
  rpm -q --changelog "$p" | grep -iE 'CVE-2026-10961[89]' || echo "No CVE entry found"
done

A matching changelog entry is useful evidence that a fix was supplied. If an entry is missing, consult the relevant vendor advisory before concluding that the package remains vulnerable.

4. Official References

• PHP Security Announcement: https://www.php.net/archive/2026.php

• PHP Changelogs: https://www.php.net/ChangeLog-8.php

• PHP Downloads: https://www.php.net/downloads.php

Need Assistance?

If you need help determining which PHP versions are installed on your self-managed VPS or dedicated server, please open a support ticket with your server details.

HostRainbow will continue monitoring relevant security updates and applying fixes within the scope of our hosting services.

HostRainbow Support Team
https://hostrainbow.in