PHP Security Advisory: CVE-2026-109618 and CVE-2026-109619
Last updateresolvedOct 22 · 03:38 UTC
We are aware of two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, announced on October 21, 2026. These vulnerabilities may allow attackers to execute malicious code on affected systems. ------------------------------------ Actions Taken ------------------------------------ For servers running cPanel/CloudLinux and H-Sphere under our management, we have applied the available security updates and made additional PHP configuration changes to help mitigate the vulnerabilities: session.upload_progress.enabled = 0 session.upload_progress.cleanup = Off These configuration changes provide additional hardening alongside the security updates. ------------------------------------ Self-Managed Servers ------------------------------------- Customers who manage their own servers are responsible for applying the relevant PHP security updates and recommended PHP configuration changes. For assistance with updating your server or applying the recommended PHP configuration changes, please contact our support team at support@cartika.com. ------------------------------------- Cloudflare Protection ------------------------------------- For domains using Cloudflare, Cloudflare has deployed Web Application Firewall (WAF) rules to help protect against known attempts to exploit these PHP vulnerabilities. This provides an additional layer of security for your website. However, we still recommend updating PHP and applying the recommended configuration changes to ensure your server is properly protected. For managed VMs, we have applied the available PHP security updates and recommended configuration changes. For self-managed VMs, customers are responsible for applying the required PHP updates and configuration changes. If you need assistance or more info, please contact our support team at support@cartika.com. ------------------------------------- Need Assistance or Patch Verification? ------------------------------------- If you have questions about these vulnerabilities, need help determining whether your server is affected, or would like a report confirming your server's patch status, please contact our support team at support@cartika.com. -------------------------------------- Additional Resources -------------------------------------- PHP Security Announcement: https://www.php.net/archive/2026.php#2026-10-21-5 cPanel Security Advisory: https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619 CloudLinux Security Advisory: https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619 Cloudflare WAF Protection: https://blog.cloudflare.com/php-vulnerabilities-waf-protection ------------------------------------- We take the security of our hosting environments seriously and have taken steps to address these vulnerabilities on the managed servers within our scope. Thank you,
Reported by Cartika on their status page.