Hello,
Today (21 October 2026) the PHP project released an emergency security update fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.
These flaws can allow unauthenticated remote code execution (RCE) and affect all PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP.
FIXED VERSIONS
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
- PHP 8.1, 8.0, 7.4 and older → no official update from PHP. Please plan to move to PHP 8.3 or newer.
CURRENT STATUS
At the time of writing, cPanel and CloudLinux have not yet released the patched PHP packages for our servers. CloudLinux is preparing updated alt-php packages, and our team is monitoring closely. We will roll out the updates across all our Pakistan and international servers as soon as they become available.
========================================
IMPORTANT: TAKE YOUR OWN BACKUP NOW
========================================
Before the update is applied, every customer should take a full backup of their website and download it to their own computer. Please do this today.
How to take a backup from cPanel:
1. Log in to cPanel.
2. Go to Files → Backup Wizard → Back Up → Full Backup.
3. Choose "Home Directory" as the destination and click Generate Backup.
4. When the backup is ready, download the file to your computer.
Alternatively, from cPanel → Backup you can download your Home Directory and each MySQL database separately.
WordPress users can also export a copy using a backup plugin such as UpdraftPlus or All-in-One WP Migration, and save it to your computer or cloud storage.
========================================
1) SHARED, UNLIMITED, LOCAL, eCOMMERCE & CLOUD HOSTING
========================================
PHP on our servers is managed by HostingWalay, so you don't need to install anything. Our servers run CloudLinux with Imunify360, which provides an interim WAF rule for these vulnerabilities, and we will apply the patched PHP versions as soon as they are released.
We also recommend you:
- Check your PHP version in cPanel → Select PHP Version. If you are on PHP 8.1 or older, switch to PHP 8.3 or newer and test your website afterwards.
- Update WordPress core, themes and plugins, and any other CMS you use (WooCommerce, Magento, OpenCart, Laravel apps, etc.).
========================================
2) WORDPRESS & MANAGED WORDPRESS HOSTING
========================================
We will apply the PHP update for you as soon as it is available. Please take your own backup as described above, and make sure your plugins and themes are up to date.
========================================
CLOUDFLARE USERS
========================================
Cloudflare has deployed WAF mitigations, but this does not remove the vulnerability. Updating PHP is the only complete fix.
For the full advisory, visit php.net.
We will email you again once the patched packages have been rolled out. If you need any help taking a backup or changing your PHP version, our engineers are available 24/7 in English and Urdu:
Submit a ticket: https://hostingwalay.pk/submit-ticket
Email: support@khalidgroup.co
WhatsApp / Phone: 0334-2542543 (https://wa.me/923342542543)
Best Regards,
The HostingWalay Team
