Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619: patched in the latest ispmanager release

1. What happened

On October 21, the PHP development team released an emergency security update. It fixes two critical vulnerabilities in the PHP core, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on CVSS v4.0, which puts them in the Critical category.

Both are remote code execution (RCE) vulnerabilities. A successful attack lets an attacker run arbitrary code on the server. Because the flaws are in the PHP interpreter itself, they affect every website and application that runs on PHP, including WordPress, WooCommerce, Drupal, Bitrix, and custom-built projects.

ispmanager has quickly released patched builds for current PHP versions and for end-of-life ones too. We know many projects still run on older PHP versions, and moving to a newer branch often takes time. That’s why we backported the fixes to end-of-life versions ourselves, all the way back to PHP 5.4. Builds for both current and older branches are ready to install now.

2. What ispmanager users should do

Install the updated PHP builds in ispmanager.

Builds for current PHP versions

• 8.2.35-1781
• 8.3.36-1781
• 8.4.27-1781
• 8.5.12-1781

Builds for end-of-life PHP versions

• 5.4.45-1794
• 5.5.38-1794
• 5.6.40-1786
• 7.0.33-1786
• 7.1.33-1786
• 7.2.34-1786
• 7.3.33-1786
• 7.4.33-1782
• 8.0.30-1782
• 8.1.34-1782

Native PHP builds with limits module support for AlmaLinux 9/10

• 8.0.30-8.el9.alma.1.857351
• 8.3.36-1.el10.857351

3. How to update

Update all system packages. Go to Software configuration, click Update on the toolbar, then select Update the list of available software and Update software. You can also do this with your OS package manager.

Update a specific PHP version manually. Run:

# Debian-based systems
apt update && apt install isp-php83
# RHEL-based systems
yum install isp-php83

Packages are named isp-php<version>, so 83 here means PHP 8.3.

Restart the services that use PHP. Go to All sections → Server management → Services and restart:

• the Apache web server: httpd and httpd-isp* on RHEL-based systems, apache2 and apache2-isp* on Debian-based systems;
• PHP-FPM services: php-fpm, php-fpm*, php<version>-fpm.