TREN
Blog

Cybersecurity

Critical PHP Core RCE: Triage and Mitigation for CVE-2026-109618 and CVE-2026-109619

2026-10-26 · İsmail İşler

  • Cybersecurity
  • CVE-2026-109618
  • PHP
  • Sysadmin
  • cPanel
  • DevOps

Critical unauthenticated PHP Core RCE flaws (CVE-2026-109618 and CVE-2026-109619) disclosed. Patch verification and remediation guide for cPanel/EasyApache.

On October 21, 2026, the PHP development team pushed out emergency out-of-band updates addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

This is not a theoretical bug. It is an unauthenticated Remote Code Execution (RCE) affecting nearly the entire PHP version landscape—from legacy PHP 5.0 up to current 8.5 releases. If you run cPanel, WHM, EasyApache, or bare LAMP stacks, your servers are in the crosshairs until patched.

Threat Profile & Root Cause

The vulnerability sits inside PHP's core request processing pipeline. Because PHP serves as the native interpreter for millions of monolithic apps and WordPress sites, an arbitrary code execution bug at runtime bypasses conventional application-level web application firewalls (WAFs).

Once an attacker fires a working payload: * They immediately gain an interactive shell under the web server daemon user (`nobody`, `www-data`, or `apache`). In shared environments with loose kernel isolation, chaining this with a local privilege escalation (LPE) vector yields root in minutes. Database exfiltration, persistent backdoor deployment, and lateral network pivoting follow immediately.

cPanel/WHM and EasyApache4 have pushed emergency patched builds to their upstream mirrors.

Quick Server Audit

Before digging through individual package repos, run this one-liner over SSH to inventory every active PHP binary currently registered on your host:

Bash
rpm -qa | grep -E '^ea-php[0-9]{2}-php-[0-9]' | sort

Vulnerable vs. Patched Targets (EasyApache4 / cPanel)

Audit your installed server packages immediately against the safe baseline below:

  • PHP 7.4: Vulnerable <= 7.4.33-18 ➔ Safe Patched: ea-php74-7.4.33-19

  • PHP 8.0: Vulnerable <= 8.0.30-11 ➔ Safe Patched: ea-php80-8.0.30-12

  • PHP 8.1: Vulnerable <= 8.1.34-4 ➔ Safe Patched: ea-php81-8.1.34-5

  • PHP 8.2: Vulnerable <= 8.2.34 ➔ Safe Patched: ea-php82-8.2.35

  • PHP 8.3: Vulnerable <= 8.3.35 ➔ Safe Patched: ea-php83-8.3.36

  • PHP 8.4: Vulnerable <= 8.4.26 ➔ Safe Patched: ea-php84-8.4.27

  • PHP 8.5: Vulnerable <= 8.5.11 ➔ Safe Patched: ea-php85-8.5.12

Immediate Remediation Steps

1. cPanel / EasyApache4 (CentOS / AlmaLinux / Rocky Linux)

Do not wait on automated overnight cron cycles. Run this directly over SSH:

Invalidate stale repo caches and fetch fresh metadata

code
yum clean all && yum makecache

Run system-level package upgrades

code
/scripts/rpmup

Confirm package integrity (Example: PHP 8.2)

code
rpm -qa | grep ea-php82

Look for release 8.2.35 or newer. Once verified, restart your daemon workers to purge stale threads from memory:

code
/scripts/restartsrv_apache
code
/scripts/restartsrv_apache_php_fpm

2. Standalone Ubuntu / Debian (Native & Ondřej Surý PPA)

For bare LAMP/LEMP nodes without a web control panel:


Refresh repository indices

code
sudo apt-get update

Upgrade running PHP runtimes

code
sudo apt-get --only-upgrade install php*-fpm php*-cli

Restart active pools and web server daemons

code
sudo systemctl restart php*-fpm && sudo systemctl restart nginx

Post-Patch Verification: Were You Already Compromised?

Patching the binary blocks subsequent attacks, but it does not kill backdoors planted prior to mitigation. Execute these rapid triage checks across the host:

  • Inspect for interactive shells under web daemon privileges:

code
ps aux | grep -E '(nobody|www-data|apache)' | grep -E '(bash|sh|python|perl|nc)'

Check webroots for recently created or modified PHP files/backdoors:

code
find /home/*/public_html -type f -name "*.php" -mtime -2 -ls

Check ephemeral scratch storage for unlinked executables:

code
find /tmp /var/tmp /dev/shm -type f -mtime -2 -exec ls -la {} +

Verify persistence inside daemon cron registries:

code
crontab -u nobody -l && crontab -u www-data -l

Architectural Takeaways: Killing the Blast Radius

​Exposing monolithic interpreters directly to the internet will always carry zero-day risks. The defense is process isolation:

  1. ​Strict Containerization: Run runtime services inside read-only, non-root Docker containers stripped of basic network binaries (curl, wget, nc). Even if someone lands a shell, they are trapped in an ephemeral box.

  2. ​Decoupled Architecture: Move presentation layers to edge platforms (Next.js/Node) and keep APIs private behind zero-trust tunnels (e.g., Cloudflare Tunnel). An unauthenticated public request should never directly touch host system memory.