Dear Customer,
Two critical vulnerabilities have been reported in PHP: CVE-2026-109618 and CVE-2026-109619. They may allow an attacker to run code on an affected server. Security researchers have reported exploitation activity, and security updates are available.
Please update the PHP version for your website through cPanel as soon as possible:
-
Sign in to your hosting account and open cPanel.
-
Find MultiPHP Manager, Select PHP Version, or a similarly named PHP settings tool.
-
Select the domain or website you want to update.
-
Choose a PHP version that your hosting provider lists as patched and supported. The reported upstream fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; your host may provide the fix through a different package version.
-
Apply or save the change, then check that your website is working as expected.
Before changing versions, check that your website, themes, and plugins support the PHP version you select. If the patched version is not available in cPanel, or you’re unsure which option to choose, contact your hosting provider for help. Please don’t leave your site on an affected version while waiting for a response; ask the provider about an available fix or other protective steps.
For further information, see the PHP vulnerability FAQ.
Regards,
SDeCLOUD Team
