FullHost - Notice history

CloudLinux has released updated PHP 8.2, 8.3, 8.4 and 8.5 packages that carry the same version numbers published on PHP.net (8.2.35, 8.3.36, 8.4.27 and 8.5.12). These packages have been installed on all Elastic Hosting, Reseller Hosting and Managed WordPress servers. Managed VMs running CloudLinux/Imunify360 will receive them within the next 24 hours.

We want to reiterate that this update is cosmetic. It changes only the version number that php -v and phpinfo() report; it contains no additional security fix. All FullHost-managed servers were patched against CVE-2026-109618 and CVE-2026-109619 on October 21, within hours of the patches becoming available, and have been protected since then.

We are receiving a high volume of questions from clients who see PHP 8.5.11, 8.4.26, 8.3.35, 8.2.34 or older versions on their accounts and are concerned their site is not patched. We understand the confusion this causes and want to address it directly.

Your PHP is patched, even if the version number hasn’t changed.

PHP on most FullHost servers is supplied by CloudLinux HardenedPHP, not directly by PHP.net. CloudLinux chose to deliver the fix for CVE-2026-109618 and CVE-2026-109619 by backporting it into the PHP versions they already ship, rather than rebuilding on the new PHP.net release numbers (8.5.12, 8.4.27, 8.3.36, 8.2.35). This is the same approach used by Red Hat, Debian, Ubuntu and most other Linux distributions for security fixes. The result is a package such as 8.5.11-2.cloudlinux.1 that contains exactly the same fix as PHP.net’s 8.5.12, while php -v and phpinfo() continue to display 8.5.11.

CloudLinux will align the version numbers – but this changes nothing about your security.

CloudLinux has announced on their status page (https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5) that they will publish PHP builds carrying the PHP.net version numbers. We will apply those packages when they are released. However, we want to be clear that this is a cosmetic alignment of version strings to reduce confusion. It does not contain any additional security fix. Every FullHost-managed server was patched against both CVEs on October 21.

All servers managed by FullHost have been patched against CVE-2026-109618 and CVE-2026-109619. The majority of our servers were patched within minutes of PHP lifting the embargo; the remainder followed once our third-party vendor (CloudLinux) released patched packages.

On our platform, every PHP version from 8.5 all the way back to 5.6 has received the fix. However, PHP versions below 8.2 are end-of-life and this patch was only possible because CloudLinux backported it. There is no guarantee that future vulnerabilities will be patched for these versions. We strongly recommend moving all sites to a supported PHP version (8.2 or newer, preferably 8.5).

cPanel customers can change this under Software → MultiPHP Manager.

A note on version numbers

PHP.net lists the fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On servers running CloudLinux, the fix has instead been backported into the existing version numbers, so php -v or phpinfo() may still display the previous version (for example 8.5.11 rather than 8.5.12) even though the vulnerability is fixed. This is standard practice for CloudLinux and other Linux distributions and is not a sign that the server is unpatched. Some third-party vulnerability scanners that check only the version string may incorrectly flag these servers as vulnerable.

Patching is continuing across our platforms. Please note that in some cases we are waiting for CloudLinux to release the patched alt-php packages before the remaining PHP versions can be updated on those servers. We expect all FullHost managed systems to be fully patched within the next few hours.

The interim mitigations (Imunify360 ruleset and session.upload_progress.enabled = Off) remain active in the meantime.

We will post a final update once patching is complete.

The PHP security release is now available and we have begun patching our systems. Fixed packages are being applied for all PHP versions down to PHP 7.4, so sites running older PHP versions on our platform will also receive the fix.

Patching is being rolled out in the following order:

1. Elastic Hosting

2. WordPress Hosting

3. Reseller Hosting

4. Managed Security VMs

5. Managed VMs

No action is required on your part. The interim mitigations (Imunify360 ruleset and session.upload_progress.enabled = Off) remain in place until patching is complete, after which the upload progress setting will be reverted.

Although this patch covers PHP 7.4 and newer on our platform, our recommendation remains unchanged: please move your sites to a current PHP version, preferably PHP 8.5, to ensure you continue to run a supported release and receive future security updates. cPanel customers can change this under Software → MultiPHP Manager.

We will post a further update once patching is complete across all platforms.

As a further temporary mitigation measure that came to light last night, we have set session.upload_progress.enabled = Off on all Elastic Hosting, WordPress Hosting, Reseller Hosting and Managed VPS servers. This disables PHP’s session upload progress tracking, which the publicly circulating exploit pattern relies on. This feature is rarely used by applications, so no impact is expected on your sites.

If you operate an unmanaged VM or a CoreGrid PaaS environment, we advise setting session.upload_progress.enabled = Off in your php.ini for the time being and restarting PHP-FPM or your web server for the change to take effect. This is a partial mitigation only and does not replace the upcoming PHP security update.

Imunify360, which protects all FullHost Elastic Hosting, WordPress Hosting and Reseller Hosting servers, as well as Managed VPS servers where the Imunify360 add-on has been purchased, has released a ModSecurity ruleset update (version 8.83, now in the Stable channel) as a temporary mitigation for CVE-2026-109618 / CVE-2026-109619.

The ruleset includes a blocking rule for the publicly circulating exploit pattern, which targets PHP’s session upload progress handling in multipart requests, along with a telemetry rule to track related activity. Servers running Imunify360 with its WAF (ModSecurity) enabled receive this ruleset automatically – no action is required on your part. Exploitation attempts matching this pattern are already being observed, and additional heuristic rules are being prepared.

Please note that this is an interim mitigation, not a complete fix. The official PHP security release remains scheduled for today, October 21, 2026 at 14:00 UTC (7:00 AM Pacific), and we will begin patching all systems as soon as it is available.

Our earlier recommendation stands: if any of your sites are running an unsupported PHP version (8.1 or older), switch them to PHP 8.2 or newer now.