How to Fix the Critical PHP RCE Vulnerability on cPanel Servers

Protect your website and server from critical PHP security flaws. Learn how to identify affected PHP versions, install the latest security patches, and secure your cPanel and WHM hosting environment.

Don’t let an outdated PHP installation put your website and business at risk.

On October 2026, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, prompted an urgent security response. Both vulnerabilities can potentially allow remote code execution (RCE), making immediate patching a priority for website owners, hosting providers and server administrators.

In this guide prepared by Tech Cybers web hosting expers, we explain what these PHP vulnerabilities are, which versions are affected, and how to fix the security issue on cPanel and WHM servers.

What Is the PHP RCE Vulnerability?

Remote Code Execution (RCE) is a serious security vulnerability that can allow an attacker to execute commands or code on a remote server under certain conditions. Depending on the server configuration and the privileges available to the vulnerable process, successful exploitation can put website files, databases and other resources at risk.

The October 2026 PHP security release addresses two critical vulnerabilities:

Both vulnerabilities have been rated critical, with a CVSS v4.0 score of 9.2. The vulnerabilities affect PHP itself, rather than being limited to a particular WordPress plugin, theme or content management system.

According to the official PHP security announcement, administrators should update to a fixed release as soon as possible.

How to Fix the Critical PHP RCE Vulnerability on cPanel Servers

Step 1: Check the PHP Version Used by Your Website

Before applying updates, identify the PHP version assigned to each website.

Log in to your cPanel account.

Open MultiPHP Manager, if available.

Find your domain in the domain list.

Check the PHP version assigned to it.

Repeat this check for your other domains and subdomains.

You can also check the PHP version from WordPress by opening Tools → Site Health → Info → Server.

Remember that the PHP version shown for a website may differ from the PHP version used by command-line scripts. A server administrator should check all PHP versions and execution methods installed on the server.

Step 2: Update cPanel and WHM

If you have root access to WHM, update cPanel and WHM to a release containing the applicable security fixes.

Log in to WHM with administrator privileges.

Navigate to WHM → Server Configuration → Update Preferences.

Confirm that the server’s update settings are appropriate.

Open WHM → cPanel → Upgrade to Latest Version.

Allow the update to finish and review any reported errors.

Use a supported cPanel release that includes the relevant security fixes, and follow the official cPanel advisory for your installed branch.

Official instructions: cPanel and WHM Update Guide.