The PHP project expects to release security updates on October 22, 2026. These updates fix two vulnerabilities in PHP. cPanel & WHM includes or uses PHP, so these vulnerabilities can affect your cPanel & WHM installations. The PHP project rates both vulnerabilities as Critical. These vulnerabilities are in PHP. They are not in the cPanel & WHM code.
Patches & Affected Versions
We will release updated PHP packages for cPanel & WHM as soon as possible after the PHP project releases its fixes. cPanel will deliver these updates through the standard update process. Delivery is via the usual distribution channels for cPanel & WHM and EasyApache.
Versions Impacted: Versions as low as PHP5
- CVE-2026-109618: cPanel & WHM affected versions 110.0.152, 134.0.65, 136.0.49, and 138.0.17
- CVE-2026-109619: cPanel & WHM affected versions 110.0.152, 134.0.65, 136.0.49, and 138.0.17
Patches will be available for cPanel & WHM versions 110, 134, 136, and 138.
Prepare Now
- Identify affected systems. Make a list of your cPanel & WHM installations and the PHP versions that they use.
- Check the update configuration. Make sure that your systems can receive updates. If you disabled automatic updates or pinned a version, review your configuration now so there are no delays when the patch is available. If automatic updates are disabled, verify the current version and update.
- Find end-of-life PHP versions. Make a list of sites or applications that use PHP versions that do not get security updates. Plan to move them to a supported version.
- Brief your team. If your environment requires a maintenance window, tell the relevant people so they are ready to act.
- Watch for a follow-up email with the exact patched versions and a link to the full technical details.
We will send a follow-up email when the patches are available, with full details and remediation steps.
Copyright © 2026 All Rights Reserved
