PHP RCE vulnerabilities

Mitigations for CVE-2026-115560 are in place since October 21st.

CloudLinux will release new versions that match the php.net version numbers to avoid confusion.

Jetbackup patches has been rolled out, and we've opened up for the firewall again to allow access to it.

All systems patched for customer/internet facing PHP applications. We keep the Backup software unavailable for now, due to still waiting for the patch. Backups are still performed, and we as staff, can still perform restores.

We will update this post accordingly as we see updates for that.

CloudLinux 9 systems (cPanel):
ea-php56-php-common-5.6.40-25.el9.cloudlinux.18.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php70-php-common-7.0.33-29.el9.cloudlinux.17.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
ea-php71-php-common-7.1.33-20.el9.cloudlinux.17.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
ea-php72-php-common-7.2.34-12.el9.cloudlinux.18.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
ea-php73-php-common-7.3.33-15.el9.cloudlinux.18.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
ea-php74-php-common-7.4.33-18.el9.cloudlinux.13.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php80-php-common-8.0.30-11.el9.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php81-php-common-8.1.34-4.el9.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php82-php-common-8.2.34-2.el9.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php83-php-common-8.3.35-2.el9.cloudlinux.2.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php83-php-common-8.3.35-2.el9.cloudlinux.2.x86_64:   url_scanner_ex.c and ext/json/json_scanner.c for the CVE-2026-109618/109619 patch: el7/el8 re2c 0.14.3
ea-php84-php-common-8.4.26-2.el9.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: do not bail out from inside the
ea-php85-php-common-8.5.11-2.el9.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: do not bail out from inside the

CloudLinux 8 systems (cPanel):
ea-php56-php-common-5.6.40-25.el8.cloudlinux.18.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php70-php-common-7.0.33-29.el8.cloudlinux.17.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
ea-php71-php-common-7.1.33-20.el8.cloudlinux.17.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
ea-php72-php-common-7.2.34-12.el8.cloudlinux.18.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
ea-php73-php-common-7.3.33-15.el8.cloudlinux.18.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
ea-php74-php-common-7.4.33-18.el8.cloudlinux.13.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php80-php-common-8.0.30-11.el8.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php81-php-common-8.1.34-4.el8.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php82-php-common-8.2.34-2.el8.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php83-php-common-8.3.35-2.el8.cloudlinux.2.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
ea-php83-php-common-8.3.35-2.el8.cloudlinux.2.x86_64:   url_scanner_ex.c and ext/json/json_scanner.c for the CVE-2026-109618/109619 patch: el7/el8 re2c 0.14.3
ea-php84-php-common-8.4.26-2.el8.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: do not bail out from inside the
ea-php85-php-common-8.5.11-2.el8.cloudlinux.1.x86_64: - EA4D-1101: CVE-2026-109618, CVE-2026-109619: do not bail out from inside the

CloudLinux 9 systems (Grid Hosting):
alt-php73-common-7.3.33-82.el9.x86_64: - CVE-2026-109618: do not bail out from inside the memory manager; an
alt-php73-common-7.3.33-82.el9.x86_64: - CVE-2026-109619: clear the error and exception handler globals at request
alt-php74-common-7.4.33-81.el9.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
alt-php80-common-8.0.30-69.el9.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
alt-php81-common-8.1.34-39.el9.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
alt-php82-common-8.2.34-7.el9.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator,
alt-php83-common-8.3.35-6.el9.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator,
alt-php84-common-8.4.26-5.el9.x86_64: - CVE-2026-109618: do not bail out from inside the memory manager; allocation
alt-php84-common-8.4.26-5.el9.x86_64: - CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot
alt-php85-common-8.5.11-5.el9.x86_64: - CVE-2026-109618: do not bail out from inside the memory manager; allocation
alt-php85-common-8.5.11-5.el9.x86_64: - CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot

CloudLinux 10 systems (Grid Hosting):
alt-php73-common-7.3.33-82.el10.x86_64: - CVE-2026-109618: do not bail out from inside the memory manager; an
alt-php73-common-7.3.33-82.el10.x86_64: - CVE-2026-109619: clear the error and exception handler globals at request
alt-php74-common-7.4.33-81.el10.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
alt-php80-common-8.0.30-69.el10.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
alt-php81-common-8.1.34-39.el10.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator
alt-php82-common-8.2.34-7.el10.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator,
alt-php83-common-8.3.35-6.el10.x86_64: - CVE-2026-109618, CVE-2026-109619: security hardening in the memory allocator,
alt-php84-common-8.4.26-5.el10.x86_64: - CVE-2026-109618: do not bail out from inside the memory manager; allocation
alt-php84-common-8.4.26-5.el10.x86_64: - CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot
alt-php85-common-8.5.11-5.el10.x86_64: - CVE-2026-109618: do not bail out from inside the memory manager; allocation
alt-php85-common-8.5.11-5.el10.x86_64: - CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot

AlmaLinux 10 systems (Mail):
alt-php85-common-8.5.11-5.el10.x86_64: - CVE-2026-109618: do not bail out from inside the memory manager; allocation
alt-php85-common-8.5.11-5.el10.x86_64: - CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot

Server nl-mail02 fully patched for Grid Hosting with PHP 8.5

Server nlsh07 fully patched for Grid Hosting with PHP 7.3 -> PHP 8.5. (The only CloudLinux 10 based system).

On cPanel servers, all PHP versions (5.6 -> 8.5) has been patched. These are shipped via the repackaged EasyApache PHP builds (cPanel specific).

On Grid Hosting servers, some servers have patches for 7.4, 8.1, 8.3, 8.4, while others have yet to receive patches.

We are starting to receive patches.

Still pending release from CloudLinux repositories. We're monitoring the situation, We check for repository changes roughly every 5 minutes. We continue to monitor for suspicious requests across all servers.

The initial PHP 7.4 packages on EL10 patched. Remaining pending from CloudLinux.