Security bulletin: October 21, 2026
Following the disclosure of critical vulnerabilities CVE-2026-109618 and CVE-2026-109619, Nuagerie carried out a priority response on its managed cPanel hosting platform. Our technical team tracked official advisory updates, deployed applicable fixes and performed checks to confirm that the patches were present and active in the affected PHP environments.
Response status: fixes for both vulnerabilities have been verified across every PHP branch installed on this platform. Complementary WAF protections were also checked, and post-deployment validation was completed.
A coordinated response to a critical alert
Our response was informed by publications from the PHP project, CloudLinux and cPanel. As fixes were released progressively for different versions and package families, our team verified their actual availability and applicability to our environments before each deployment.
This process brought together security advisory tracking, package validation, staged deployment and operational checks. It enabled us to address the affected components methodically while checking configuration preservation and hosting service behaviour.
Understanding the vulnerabilities
Both vulnerabilities affect memory handling and internal state in the PHP engine. They are classified as critical, with a CVSS v4 score of 9.2, and can allow an unauthenticated attacker to execute code remotely on a vulnerable installation.
- CVE-2026-109618: a flaw in out-of-memory handling can leave PHP in an inconsistent internal state.
- CVE-2026-109619: stale internal data can be reused after memory has been freed during the processing of a subsequent request.
Exploitation conditions vary with the execution mode and application. Given the severity of these vulnerabilities, our response covered every PHP branch installed on the affected platform.
Controlled deployment with validation at each stage
Our team structured the intervention around several complementary checks:
- Vendor patch tracking: reviewing official advisories and checking repositories repeatedly to identify patched builds that were actually available.
- Pre-installation validation: checking package signatures, reviewing the scope of each update and verifying recovery material and the configurations to preserve.
- Staged deployment: installing applicable fixes in successive batches, according to availability and the different PHP package families used by the platform.
- Remediation confirmation: checking installed package changelogs for explicit references to both CVEs across each affected PHP branch.
- Activation checks: verifying renewal of the observed PHP processes and the absence of deleted PHP components still loaded in memory.
- Post-deployment checks: comparing service state, protected configuration integrity and the behaviour of the HTTPS endpoints reviewed.
These checks confirm both the installation of the fixes and their use by the processes examined. They reflect our emphasis on traceability and controlled changes to the hosting infrastructure.
WAF protections and security event review
Alongside the PHP updates, we verified the presence of the Imunify360 ruleset strengthened for these vulnerabilities in our web application firewall (WAF). The events reviewed confirmed that this ruleset was in use during the intervention.
These protections help detect and filter known forms of exploitation attempts. Their verification accompanied checks of packages, processes and services, providing several concrete observations about the operation of the protective measures.
The WAF provides an additional defensive layer. Patching the PHP engine remains essential, in line with vendor recommendations. Our response therefore combined fixes to the underlying vulnerabilities, application-layer protection and operational verification.
Verification suited to CloudLinux patches
CloudLinux distributes some fixes as backports: a security correction can be incorporated into a package without changing the main PHP version number displayed by an application. Identifying a patched build therefore requires the full package version and its changelog.
Our checks followed this verification method, described on the official CloudLinux status page. They examined the packages actually installed and explicit references to both vulnerabilities. The official cPanel advisory provides further details about patched versions in that environment.
What this means for our customers
Customers whose websites use the PHP versions provided by our managed cPanel hosting platform do not need to install these server patches manually. Nuagerie has handled their deployment and verification.
We also recommend keeping applications, CMS platforms, plugins and themes up to date. For self-managed PHP installations, separately administered servers or containers outside this platform, updates should be verified with the administrator responsible for that environment.
Our support team remains available for questions about PHP versions or website behaviour. If you notice an issue, include the affected website, the symptoms observed and the time of the observation to help with the investigation.
Clarify the next step for your own application
The platform response described above gives customers a clear point of reference when discussing their own website. If your application also uses a separately managed service or runtime, our team can help clarify the hosting boundary and identify the administrator who should verify that component.
For a follow-up through the client area, include the application or site concerned, any separate service involved and the question you need answered. For a functional issue, say which user action fails and whether it is reproducible. These details help distinguish a question about the bulletin’s scope from application troubleshooting and direct the request accordingly.
Official references and transparency
This bulletin draws on vendor publications and checks performed during our response. The following references provide direct access to the original technical information:
- PHP project: official security advisory.
- CVE-2026-109618: PHP technical advisory and official CVE record.
- CVE-2026-109619: PHP technical advisory and official CVE record.
- Official PHP repository: PHP 8.3 branch fix addressing both vulnerabilities.
- PHP project: official changelog.
Protecting our customers requires a prompt response, controlled deployments and verifiable results. Our team applied these principles throughout this intervention, with particular attention to the security of PHP environments and the stability of hosting services.
