To complicate things, major shared hosting providers have patched #PHP against #php2shell using a backport — without incrementing the version number displayed by phpinfo.
On the plus side – and it's a massive plus – this means that for many sites, versions as old as 5.2 are protected, even though the PHP Team only released official patches for 8.2 and newer.
On the minus side, if you run a website there's no obvious way to tell whether you're using the new or old version.
This explains why, across the various websites I manage, even really old versions of PHP have build dates of Wednesday afternoon a few hours after the official fixes. It seems almost too good to be true.
CloudLinux explained: "PHP.net fixed CVE-2026-109618 and CVE-2026-109619 in new PHP versions […] Our alt-php and ea-php packages carry the same fix applied to the PHP version they already shipped (a backport). These packages contain the fix for both CVEs, even though the PHP version number is lower."
Then today, CloudLinux released builds to bring the version numbers in line with the official ones.
Information from #cPanel and #CloudLinux here:
cPanelCritical PHP Security Release - CVE-2026-109618 and CVE-2026-109619SituationCritical security vulnerabilities were found in PHP, and have been assigned CVE-2026-109618 and CVE-2026-109619. For more information, you can find the official announcement here:PHP News ...