Update - Fixed alt-nodejs 16, 18 and 20 and ea-nodejs22 are now in the stable repositories
- alt-nodejs16: alt-nodejs16-nodejs-16.20.2-33, for CloudLinux OS 7, 8 and 9
- alt-nodejs18: alt-nodejs18-nodejs-18.20.8-26, for CloudLinux OS 7, 7 Hybrid, 8 and 9
- alt-nodejs20: alt-nodejs20-nodejs-20.20.2-15, for CloudLinux OS 7, 8 and 9
- ea-nodejs22 (cPanel EasyApache 4): ea-nodejs22-22.23.4-1.el8.cloudlinux, for CloudLinux OS 8
To update:
CloudLinux OS 7: yum clean all && yum update 'alt-nodejs16*' 'alt-nodejs18*' 'alt-nodejs20*'
CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs16*' 'alt-nodejs18*' 'alt-nodejs20*'
cPanel servers on CloudLinux OS 8: dnf upgrade ea-nodejs22
Then restart your Node.js applications. For alt-nodejs 16, 18 and 20 the CVE IDs are listed in the package changelog.
Fixed builds are now available for alt-nodejs 12, 14, 16, 18, 20, 22, 24 and 26 on CloudLinux OS 8 and 9, and alt-nodejs 12, 14, 16, 18 and 20 on CloudLinux OS 7. alt-nodejs22 for CloudLinux OS 7 has been released and is reaching the repositories now.
Fixed builds for other older versions, such as alt-nodejs10 and alt-nodejs19, are not released. We will post here if that changes.
This incident covers alt-nodejs and ea-nodejs22. The operating system's own nodejs packages will be updated when the fix arrives through the regular RHEL / AlmaLinux updates.
Oct 22, 2026 - 17:46 UTC
- alt-nodejs16: alt-nodejs16-nodejs-16.20.2-33, for CloudLinux OS 7, 8 and 9
- alt-nodejs18: alt-nodejs18-nodejs-18.20.8-26, for CloudLinux OS 7, 7 Hybrid, 8 and 9
- alt-nodejs20: alt-nodejs20-nodejs-20.20.2-15, for CloudLinux OS 7, 8 and 9
- ea-nodejs22 (cPanel EasyApache 4): ea-nodejs22-22.23.4-1.el8.cloudlinux, for CloudLinux OS 8
To update:
CloudLinux OS 7: yum clean all && yum update 'alt-nodejs16*' 'alt-nodejs18*' 'alt-nodejs20*'
CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs16*' 'alt-nodejs18*' 'alt-nodejs20*'
cPanel servers on CloudLinux OS 8: dnf upgrade ea-nodejs22
Then restart your Node.js applications. For alt-nodejs 16, 18 and 20 the CVE IDs are listed in the package changelog.
Fixed builds are now available for alt-nodejs 12, 14, 16, 18, 20, 22, 24 and 26 on CloudLinux OS 8 and 9, and alt-nodejs 12, 14, 16, 18 and 20 on CloudLinux OS 7. alt-nodejs22 for CloudLinux OS 7 has been released and is reaching the repositories now.
Fixed builds for other older versions, such as alt-nodejs10 and alt-nodejs19, are not released. We will post here if that changes.
This incident covers alt-nodejs and ea-nodejs22. The operating system's own nodejs packages will be updated when the fix arrives through the regular RHEL / AlmaLinux updates.
Oct 22, 2026 - 17:46 UTC
Update - Fixed alt-nodejs 12 and 14 are now in the stable repositories
- alt-nodejs12: alt-nodejs12-nodejs-12.22.12-35, for CloudLinux OS 7, 8 and 9
- alt-nodejs14: alt-nodejs14-nodejs-14.21.3-37, for CloudLinux OS 7, 8 and 9
- alt-nodejs24 is now also in stable for CloudLinux OS 10
To update:
CloudLinux OS 7: yum clean all && yum update 'alt-nodejs12*' 'alt-nodejs14*'
CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs12*' 'alt-nodejs14*'
Then restart your Node.js applications.
For these versions the CVE IDs are listed in the package changelog:
rpm -q --changelog alt-nodejs14-nodejs | grep -E 'CVE-2026-'
If you run your own mirror of our repositories, make sure it has synced since 14:50 UTC.
Still in progress: alt-nodejs 16, 18 and 20, and ea-nodejs22 (cPanel).
Oct 22, 2026 - 15:03 UTC
- alt-nodejs12: alt-nodejs12-nodejs-12.22.12-35, for CloudLinux OS 7, 8 and 9
- alt-nodejs14: alt-nodejs14-nodejs-14.21.3-37, for CloudLinux OS 7, 8 and 9
- alt-nodejs24 is now also in stable for CloudLinux OS 10
To update:
CloudLinux OS 7: yum clean all && yum update 'alt-nodejs12*' 'alt-nodejs14*'
CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs12*' 'alt-nodejs14*'
Then restart your Node.js applications.
For these versions the CVE IDs are listed in the package changelog:
rpm -q --changelog alt-nodejs14-nodejs | grep -E 'CVE-2026-'
If you run your own mirror of our repositories, make sure it has synced since 14:50 UTC.
Still in progress: alt-nodejs 16, 18 and 20, and ea-nodejs22 (cPanel).
Oct 22, 2026 - 15:03 UTC
Update - Fixed alt-nodejs 22, 24 and 26 are now in the stable repositories for CloudLinux OS 8 and 9
They have moved from the gradual rollout to stable, so a regular update installs them:
dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' 'alt-nodejs26*'
Then restart your Node.js applications so they run the updated version.
To confirm, check the version, which should be 22.23.4, 24.22.1 or 26.12.1 or later:
rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs
Older alt-nodejs versions: fixed builds of alt-nodejs 12, 14, 16, 18 and 20 are being released, and we expect them for all CloudLinux OS versions by 16:00 UTC.
Still in progress: ea-nodejs22 (cPanel) and alt-nodejs for CloudLinux OS 7.
Oct 22, 2026 - 13:59 UTC
They have moved from the gradual rollout to stable, so a regular update installs them:
dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' 'alt-nodejs26*'
Then restart your Node.js applications so they run the updated version.
To confirm, check the version, which should be 22.23.4, 24.22.1 or 26.12.1 or later:
rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs
Older alt-nodejs versions: fixed builds of alt-nodejs 12, 14, 16, 18 and 20 are being released, and we expect them for all CloudLinux OS versions by 16:00 UTC.
Still in progress: ea-nodejs22 (cPanel) and alt-nodejs for CloudLinux OS 7.
Oct 22, 2026 - 13:59 UTC
Update - Fixed alt-nodejs 22, 24 and 26 are being released for CloudLinux OS 8 and 9
- alt-nodejs22: alt-nodejs22-nodejs-22.23.4-1
- alt-nodejs24: alt-nodejs24-nodejs-24.22.1-1
- alt-nodejs26: alt-nodejs26-nodejs-26.12.1-1
They are reaching servers gradually, so dnf upgrade may not find them on your server yet. We will confirm here when they are available on all servers.
To update:
dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' 'alt-nodejs26*'
Then restart your Node.js applications so they run the updated version.
To confirm, check the version, which should be 22.23.4, 24.22.1 or 26.12.1 or later:
rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs
Still in progress: ea-nodejs22 (cPanel), CloudLinux OS 7, and older alt-nodejs versions. We will post them here as they become available.
Oct 22, 2026 - 13:33 UTC
- alt-nodejs22: alt-nodejs22-nodejs-22.23.4-1
- alt-nodejs24: alt-nodejs24-nodejs-24.22.1-1
- alt-nodejs26: alt-nodejs26-nodejs-26.12.1-1
They are reaching servers gradually, so dnf upgrade may not find them on your server yet. We will confirm here when they are available on all servers.
To update:
dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' 'alt-nodejs26*'
Then restart your Node.js applications so they run the updated version.
To confirm, check the version, which should be 22.23.4, 24.22.1 or 26.12.1 or later:
rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs
Still in progress: ea-nodejs22 (cPanel), CloudLinux OS 7, and older alt-nodejs versions. We will post them here as they become available.
Oct 22, 2026 - 13:33 UTC
Update - Fixed builds are being built now for CloudLinux OS 7, 8 and 9 and TuxCare 7, 8, 9 and 10:
- Node.js 22: version 22.23.4
- Node.js 24: version 24.22.1
- Node.js 26: version 26.12.1
- ea-nodejs22 (cPanel): version 22.23.4
These are the same versions as the Node.js project's fixed releases. We expect them in the stable repositories in about 2 hours, by 12:40 UTC.
Builds for older alt-nodejs versions are also in progress, and we will post their status here separately. We will post the exact package versions and the update steps once the packages are available in the repositories.
Oct 22, 2026 - 10:49 UTC
- Node.js 22: version 22.23.4
- Node.js 24: version 24.22.1
- Node.js 26: version 26.12.1
- ea-nodejs22 (cPanel): version 22.23.4
These are the same versions as the Node.js project's fixed releases. We expect them in the stable repositories in about 2 hours, by 12:40 UTC.
Builds for older alt-nodejs versions are also in progress, and we will post their status here separately. We will post the exact package versions and the update steps once the packages are available in the repositories.
Oct 22, 2026 - 10:49 UTC
Identified - On 21 October 2026 the Node.js project published security releases for the 22.x, 24.x and 26.x lines (v22.23.4, v24.22.1, v26.12.1). They fix 10 vulnerabilities, and the highest severity is High. The most serious one, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can allow remote code execution. The Node.js project notes that end-of-life versions are always affected when a security release occurs.
We are aware and are building updated alt-nodejs packages for CloudLinux OS, including the end-of-life Node.js versions we ship. They are not released yet. We will post an update here as soon as fixed packages are available in the repositories, with steps to install them.
Upstream advisory: Node.js October 2026 security releases
Oct 22, 2026 - 10:28 UTC
We are aware and are building updated alt-nodejs packages for CloudLinux OS, including the end-of-life Node.js versions we ship. They are not released yet. We will post an update here as soon as fixed packages are available in the repositories, with steps to install them.
Upstream advisory: Node.js October 2026 security releases
Oct 22, 2026 - 10:28 UTC
Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 14:00 UTC
Subscribe
Update - Why fixed alt-php and ea-php packages show an older PHP version
PHP.net fixed CVE-2026-109618 and CVE-2026-109619 in new PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35). Our alt-php and ea-php packages carry the same fix applied to the PHP version they already shipped (a backport). For example, the fixed alt-php85 is 8.5.11-5, and the fixed ea-php84 is 8.4.26-2.el8.cloudlinux.1 on CloudLinux OS 8. These packages contain the fix for both CVEs, even though the PHP version number is lower. Reports that "PHP 8.5.11 is vulnerable" refer to the original PHP.net release, not to these packages.
To check a server, look for the CVE IDs in the package changelog, e.g.:
rpm -q --changelog alt-php85-common | grep -E 'CVE-2026-(109618|109619)'
rpm -q --changelog ea-php84-php-cli | grep -E 'CVE-2026-(109618|109619)'
Next: We will publish alt-php builds with the PHP.net version numbers after the Node.js package release that is in progress now (status). ea-php will move to the new version numbers as we continue syncing with cPanel EasyApache 4.
If you have already installed the fixed packages, no further action is needed.
Oct 22, 2026 - 14:31 UTC
PHP.net fixed CVE-2026-109618 and CVE-2026-109619 in new PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35). Our alt-php and ea-php packages carry the same fix applied to the PHP version they already shipped (a backport). For example, the fixed alt-php85 is 8.5.11-5, and the fixed ea-php84 is 8.4.26-2.el8.cloudlinux.1 on CloudLinux OS 8. These packages contain the fix for both CVEs, even though the PHP version number is lower. Reports that "PHP 8.5.11 is vulnerable" refer to the original PHP.net release, not to these packages.
To check a server, look for the CVE IDs in the package changelog, e.g.:
rpm -q --changelog alt-php85-common | grep -E 'CVE-2026-(109618|109619)'
rpm -q --changelog ea-php84-php-cli | grep -E 'CVE-2026-(109618|109619)'
Next: We will publish alt-php builds with the PHP.net version numbers after the Node.js package release that is in progress now (status). ea-php will move to the new version numbers as we continue syncing with cPanel EasyApache 4.
If you have already installed the fixed packages, no further action is needed.
Oct 22, 2026 - 14:31 UTC
Update - If the PHP update fails or finds nothing to install, check the cloudlinux-release package first
Some servers cannot install the fixed packages because their cloudlinux-release package is outdated. Check the installed version:
rpm -q cloudlinux-release
The current stable versions are:
- CloudLinux OS 7: 7.9-2.17
- CloudLinux OS 8: 8.10-16
- CloudLinux OS 9: 9.8-3
- CloudLinux OS 10: 10-5
(see changelog.cloudlinux.com/cloudlinux-release, switch el9 to your OS)
If yours is older, update it, clear the cache and run the PHP update again:
CloudLinux OS 7: yum update cloudlinux-release && yum clean all
CloudLinux OS 8, 9, 10: dnf update cloudlinux-release && dnf clean all
Then repeat the update steps from our previous updates, for example dnf upgrade 'ea-php*' or dnf upgrade 'alt-php*'
Oct 22, 2026 - 13:17 UTC
Some servers cannot install the fixed packages because their cloudlinux-release package is outdated. Check the installed version:
rpm -q cloudlinux-release
The current stable versions are:
- CloudLinux OS 7: 7.9-2.17
- CloudLinux OS 8: 8.10-16
- CloudLinux OS 9: 9.8-3
- CloudLinux OS 10: 10-5
(see changelog.cloudlinux.com/cloudlinux-release, switch el9 to your OS)
If yours is older, update it, clear the cache and run the PHP update again:
CloudLinux OS 7: yum update cloudlinux-release && yum clean all
CloudLinux OS 8, 9, 10: dnf update cloudlinux-release && dnf clean all
Then repeat the update steps from our previous updates, for example dnf upgrade 'ea-php*' or dnf upgrade 'alt-php*'
Oct 22, 2026 - 13:17 UTC
Update - Correction to our 05:23 UTC update on native PHP packages (the operating system's own php packages, not alt-php or ea-php).
Native PHP 8.2 and 8.3 on CloudLinux 9 and PHP 8.2 on CloudLinux 8 are in stable, and a regular update installs them.
The fixed builds for the other native versions are not in stable yet. They are in the beta channel (updates-testing), and a gradual rollout has delivered them to about 0.2% of servers so far. This covers CloudLinux 10 PHP 8.3, CloudLinux 9 PHP 8.0 and 8.1, and CloudLinux 8 PHP 7.2, 7.4 and 8.0. PHP 5.4 on CloudLinux 7 is a TuxCare ELS package and does not go through this rollout.
Native PHP 8.2 and 8.3 in stable are rebased to the PHP releases. Their changelog says only "rebase to 8.2.35" or "rebase to 8.3.36" and names no CVE IDs, so the changelog grep from our earlier updates returns nothing on them even when the server is fixed. Check the version instead. It should be 8.2.35 or 8.3.36 or later.
rpm -q php-cli
For alt-php, ea-php and the other native builds, the changelog check from the earlier updates still applies. Details are in step 3 of the blog article.
Oct 22, 2026 - 09:21 UTC
Native PHP 8.2 and 8.3 on CloudLinux 9 and PHP 8.2 on CloudLinux 8 are in stable, and a regular update installs them.
The fixed builds for the other native versions are not in stable yet. They are in the beta channel (updates-testing), and a gradual rollout has delivered them to about 0.2% of servers so far. This covers CloudLinux 10 PHP 8.3, CloudLinux 9 PHP 8.0 and 8.1, and CloudLinux 8 PHP 7.2, 7.4 and 8.0. PHP 5.4 on CloudLinux 7 is a TuxCare ELS package and does not go through this rollout.
Native PHP 8.2 and 8.3 in stable are rebased to the PHP releases. Their changelog says only "rebase to 8.2.35" or "rebase to 8.3.36" and names no CVE IDs, so the changelog grep from our earlier updates returns nothing on them even when the server is fixed. Check the version instead. It should be 8.2.35 or 8.3.36 or later.
rpm -q php-cli
For alt-php, ea-php and the other native builds, the changelog check from the earlier updates still applies. Details are in step 3 of the blog article.
Oct 22, 2026 - 09:21 UTC
Update - Fixed native PHP packages from the CloudLinux repositories (the operating system's own php packages, not alt-php or ea-php) are rolling out gradually through the stable channel. Most servers don't have them yet.
Native php packages rolling out now: CloudLinux 10 PHP 8.3, CloudLinux 9 PHP 8.0 and 8.1, CloudLinux 8 PHP 7.2, 7.4 and 8.0, CloudLinux 7 PHP 5.4. The native PHP 7.3 fix for CloudLinux 8 is still being prepared. Native PHP 8.2 and 8.3 on CloudLinux 9 and PHP 8.2 on CloudLinux 8 are already in stable.
A regular package update installs them once they reach your server. Restart PHP-FPM or the web server afterwards. alt-php and ea-php are not affected by this rollout, their fixed packages are already in stable. Details are in step 3 of the blog article.
Oct 22, 2026 - 05:23 UTC
Native php packages rolling out now: CloudLinux 10 PHP 8.3, CloudLinux 9 PHP 8.0 and 8.1, CloudLinux 8 PHP 7.2, 7.4 and 8.0, CloudLinux 7 PHP 5.4. The native PHP 7.3 fix for CloudLinux 8 is still being prepared. Native PHP 8.2 and 8.3 on CloudLinux 9 and PHP 8.2 on CloudLinux 8 are already in stable.
A regular package update installs them once they reach your server. Restart PHP-FPM or the web server afterwards. alt-php and ea-php are not affected by this rollout, their fixed packages are already in stable. Details are in step 3 of the blog article.
Oct 22, 2026 - 05:23 UTC
Update - Fixed alt-php packages for CVE-2026-109618 and CVE-2026-109619 are available in the CloudLinux OS repositories
The release to the CloudLinux OS stable repositories is complete (22 October 2026, 00:07 UTC):
- CloudLinux OS 7, 8 and 9: alt-php 5.2-5.6, 7.0-7.4 and 8.0-8.5
- CloudLinux OS for Ubuntu 22.04: alt-php 5.2, 5.6, 7.0-7.4 and 8.0-8.5 (in stable since 21 October, 21:48 UTC)
- CloudLinux OS 10: alt-php 5.2 (in stable since 21 October, 22:14 UTC); all other alt-php versions on CloudLinux OS 10 come from the ELS ALT PHP repository, where they are already available
TuxCare ELS: all fixed packages are released (alt-php, the distribution's own PHP packages and PHP for Windows).
A regular update now installs the fixed packages, and the ELS ALT PHP repository is no longer needed:
CloudLinux OS 7: yum clean all && yum update "alt-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "alt-php*"
CloudLinux OS for Ubuntu: apt-get update && apt-get upgrade
Then restart your PHP services (Apache, PHP-FPM or LiteSpeed).
If you added the ELS ALT PHP repository on CloudLinux OS 7, 8 or 9 as a temporary workaround, you can disable it and run the regular update again:
CloudLinux OS 7: yum-config-manager --disable php-els
CloudLinux OS 8, 9: dnf config-manager --set-disabled php-els
To confirm a version is fixed, check its changelog (for example, alt-php74):
rpm -q --changelog alt-php74-common | grep -E "CVE-2026-(109618|109619)"
Security advisory metadata (OVAL and UpdateInfo) is not published yet, so security-only updates such as yum --security do not list these packages. Use a regular update, as shown above.
For more details, please see our blog article: PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection
Oct 22, 2026 - 01:19 UTC
The release to the CloudLinux OS stable repositories is complete (22 October 2026, 00:07 UTC):
- CloudLinux OS 7, 8 and 9: alt-php 5.2-5.6, 7.0-7.4 and 8.0-8.5
- CloudLinux OS for Ubuntu 22.04: alt-php 5.2, 5.6, 7.0-7.4 and 8.0-8.5 (in stable since 21 October, 21:48 UTC)
- CloudLinux OS 10: alt-php 5.2 (in stable since 21 October, 22:14 UTC); all other alt-php versions on CloudLinux OS 10 come from the ELS ALT PHP repository, where they are already available
TuxCare ELS: all fixed packages are released (alt-php, the distribution's own PHP packages and PHP for Windows).
A regular update now installs the fixed packages, and the ELS ALT PHP repository is no longer needed:
CloudLinux OS 7: yum clean all && yum update "alt-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "alt-php*"
CloudLinux OS for Ubuntu: apt-get update && apt-get upgrade
Then restart your PHP services (Apache, PHP-FPM or LiteSpeed).
If you added the ELS ALT PHP repository on CloudLinux OS 7, 8 or 9 as a temporary workaround, you can disable it and run the regular update again:
CloudLinux OS 7: yum-config-manager --disable php-els
CloudLinux OS 8, 9: dnf config-manager --set-disabled php-els
To confirm a version is fixed, check its changelog (for example, alt-php74):
rpm -q --changelog alt-php74-common | grep -E "CVE-2026-(109618|109619)"
Security advisory metadata (OVAL and UpdateInfo) is not published yet, so security-only updates such as yum --security do not list these packages. Use a regular update, as shown above.
For more details, please see our blog article: PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection
Oct 22, 2026 - 01:19 UTC
Update - Last updated 21 October 2026, 23:00 UTC
- PHP released fixes for both critical vulnerabilities (CVSS v4.0 9.2): 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Update to the version for your branch. CloudLinux packages carry the fix as a backport and keep their own, lower version numbers, so confirm them by changelog instead (step 3). PHP 8.2 reaches end of life on 31 December 2026.
- Per PHP, all PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Risk is highest for mod_php.
- PHP 8.1 and older get no release from the PHP project. Its security team published minimal source backports for 7.4, 8.0, and 8.1.
- CloudLinux ea-php (cPanel EasyApache 4): fixed packages for ea-php52 through ea-php85 are released. Update, then restart Apache and PHP-FPM (step 3).
- CloudLinux alt-php: on CloudLinux 7, 8 and 9, the fixed packages are on their way to the CloudLinux stable repositories. Until they arrive, add the TuxCare ELS alt-php repository and update from it (step 3). On CloudLinux 10, a regular update installs every fixed version except alt-php 5.2, whose fix is being released to stable. On CloudLinux for Ubuntu 22.04, fixed alt-php 5.2, 5.6, 7.0 to 7.4, and 8.0 to 8.5 are in stable. CloudLinux 6 is not confirmed yet.
- Native PHP packages from the CloudLinux repositories (the operating system's own php packages, not alt-php or ea-php): fixed packages are in stable for PHP 8.2 and 8.3 on CloudLinux 9, and for PHP 8.2 on CloudLinux 8. Fixed builds for the other versions are in testing or early rollout, and not generally available yet.
- Imunify360 with the WAF enabled receives rulesets 8.83 to 8.85 automatically. On ModSecurity (Apache and Nginx) and Coraza, they block the known exploit requests and the public exploit tool. On LiteSpeed, ruleset 8.84 added blocking rules for the tool and for upload progress requests that don't come from the site's own pages. The rules target the upload progress path the public exploit uses, and no rule blocks the out-of-memory path of CVE-2026-109618 yet. This is an interim mitigation, not a fix.
For full details, commands, and the update history, please see our blog article: PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection
Oct 22, 2026 - 00:52 UTC
- PHP released fixes for both critical vulnerabilities (CVSS v4.0 9.2): 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Update to the version for your branch. CloudLinux packages carry the fix as a backport and keep their own, lower version numbers, so confirm them by changelog instead (step 3). PHP 8.2 reaches end of life on 31 December 2026.
- Per PHP, all PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Risk is highest for mod_php.
- PHP 8.1 and older get no release from the PHP project. Its security team published minimal source backports for 7.4, 8.0, and 8.1.
- CloudLinux ea-php (cPanel EasyApache 4): fixed packages for ea-php52 through ea-php85 are released. Update, then restart Apache and PHP-FPM (step 3).
- CloudLinux alt-php: on CloudLinux 7, 8 and 9, the fixed packages are on their way to the CloudLinux stable repositories. Until they arrive, add the TuxCare ELS alt-php repository and update from it (step 3). On CloudLinux 10, a regular update installs every fixed version except alt-php 5.2, whose fix is being released to stable. On CloudLinux for Ubuntu 22.04, fixed alt-php 5.2, 5.6, 7.0 to 7.4, and 8.0 to 8.5 are in stable. CloudLinux 6 is not confirmed yet.
- Native PHP packages from the CloudLinux repositories (the operating system's own php packages, not alt-php or ea-php): fixed packages are in stable for PHP 8.2 and 8.3 on CloudLinux 9, and for PHP 8.2 on CloudLinux 8. Fixed builds for the other versions are in testing or early rollout, and not generally available yet.
- Imunify360 with the WAF enabled receives rulesets 8.83 to 8.85 automatically. On ModSecurity (Apache and Nginx) and Coraza, they block the known exploit requests and the public exploit tool. On LiteSpeed, ruleset 8.84 added blocking rules for the tool and for upload progress requests that don't come from the site's own pages. The rules target the upload progress path the public exploit uses, and no rule blocks the out-of-memory path of CVE-2026-109618 yet. This is an interim mitigation, not a fix.
For full details, commands, and the update history, please see our blog article: PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection
Oct 22, 2026 - 00:52 UTC
Update - Update on fixed CloudLinux PHP packages for CVE-2026-109618 and CVE-2026-109619
Current status
- ea-php (cPanel EasyApache 4): fixed packages for ea-php52 through ea-php85 are released for CloudLinux OS 7, 8, 9 and 10.
- alt-php: on CloudLinux OS 7, 8 and 9, the fixed packages are on their way to the CloudLinux stable repositories. Until they reach the stable repository, fixed alt-php packages are available from the ELS ALT PHP repository (steps in the previous update). On CloudLinux OS 10, alt-php comes from the ELS ALT PHP repository; fixed alt-php 5.2 is being released to the stable repository. On CloudLinux OS for Ubuntu 22.04, fixed alt-php 5.2, 5.6, 7.0–7.4 and 8.0–8.5 are available in the stable repository.
- Native PHP (the operating system's own php packages, not alt-php or ea-php): fixed packages are in stable for PHP 8.2 and 8.3 on CloudLinux OS 9, and for PHP 8.2 on CloudLinux OS 8. Fixed builds for the other versions are in testing or early rollout.
How to update
ea-php (cPanel EasyApache 4):
CloudLinux OS 7: yum clean all && yum update "ea-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "ea-php*"
Then restart Apache and PHP-FPM:
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm
alt-php, where a fixed package is available:
CloudLinux OS 7: yum update 'alt-php*'
CloudLinux OS 8, 9, 10: dnf upgrade 'alt-php*'
CloudLinux OS for Ubuntu: apt-get update && apt-get upgrade
Native PHP: a regular package update installs the fixed packages; restart PHP-FPM or the web server afterwards.
How to confirm the fix
Our packages carry the fix as a backport, so their version numbers stay below PHP's (for example, ea-php84 is 8.4.26, not 8.4.27). Look for the CVE IDs in the package changelog instead:
rpm -q ea-php84-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'
Security advisory metadata (OVAL and UpdateInfo) is not published yet, so security-only updates such as yum --security do not list these packages. Use a regular update, as shown above.
Oct 21, 2026 - 22:56 UTC
Current status
- ea-php (cPanel EasyApache 4): fixed packages for ea-php52 through ea-php85 are released for CloudLinux OS 7, 8, 9 and 10.
- alt-php: on CloudLinux OS 7, 8 and 9, the fixed packages are on their way to the CloudLinux stable repositories. Until they reach the stable repository, fixed alt-php packages are available from the ELS ALT PHP repository (steps in the previous update). On CloudLinux OS 10, alt-php comes from the ELS ALT PHP repository; fixed alt-php 5.2 is being released to the stable repository. On CloudLinux OS for Ubuntu 22.04, fixed alt-php 5.2, 5.6, 7.0–7.4 and 8.0–8.5 are available in the stable repository.
- Native PHP (the operating system's own php packages, not alt-php or ea-php): fixed packages are in stable for PHP 8.2 and 8.3 on CloudLinux OS 9, and for PHP 8.2 on CloudLinux OS 8. Fixed builds for the other versions are in testing or early rollout.
How to update
ea-php (cPanel EasyApache 4):
CloudLinux OS 7: yum clean all && yum update "ea-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "ea-php*"
Then restart Apache and PHP-FPM:
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm
alt-php, where a fixed package is available:
CloudLinux OS 7: yum update 'alt-php*'
CloudLinux OS 8, 9, 10: dnf upgrade 'alt-php*'
CloudLinux OS for Ubuntu: apt-get update && apt-get upgrade
Native PHP: a regular package update installs the fixed packages; restart PHP-FPM or the web server afterwards.
How to confirm the fix
Our packages carry the fix as a backport, so their version numbers stay below PHP's (for example, ea-php84 is 8.4.26, not 8.4.27). Look for the CVE IDs in the package changelog instead:
rpm -q ea-php84-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'
Security advisory metadata (OVAL and UpdateInfo) is not published yet, so security-only updates such as yum --security do not list these packages. Use a regular update, as shown above.
Oct 21, 2026 - 22:56 UTC
Update - Fixed alt-php packages for CloudLinux OS 7, 8, and 9 are available now in the ELS ALT PHP repository.
To install them, add the repository and update alt-php using the steps below. CloudLinux OS 10 already receives alt-php from this repository and only needs a regular update.
CloudLinux OS 7, 8 and 9
1. Make sure the server is registered with CLN (this file must exist):
ls /etc/sysconfig/rhn/jwt.token || rhnreg_ks --activationkey <YOUR-KEY> --force
2. CloudLinux OS 8, 9 only: make sure cloudlinux-release is recent enough to provide the ELS ALT PHP repository package (8.10-16 or newer on CloudLinux OS 8, 9.8-3 or newer on CloudLinux OS 9).
Otherwise, the next step fails with No match for argument: els-php-release.
Update it and check the version; the update may need to run more than once to reach the latest version:
dnf update -y cloudlinux-release
rpm -q cloudlinux-release
3. Add the ELS ALT PHP repository:
CloudLinux OS 7: yum install -y els-php-release
CloudLinux OS 8, 9: dnf install -y els-php-release
4. Keep regular updates working even if the repository becomes unreachable:
CloudLinux OS 7: yum-config-manager --save --setopt=php-els.skip_if_unavailable=true
CloudLinux OS 8, 9: dnf config-manager --save --setopt=php-els.skip_if_unavailable=True
5. Check access to the repository (the output must include "Metadata cache created"):
CloudLinux OS 7: yum --disablerepo='*' --enablerepo=php-els makecache
CloudLinux OS 8, 9: dnf --disablerepo='*' --enablerepo=php-els makecache
6. Update alt-php:
CloudLinux OS 7: yum update -y 'alt-php*'
CloudLinux OS 8, 9: dnf upgrade -y 'alt-php*'
CloudLinux OS 10
Run a regular update:
dnf upgrade -y 'alt-php*'
After updating, restart your PHP services (Apache, PHP-FPM or LiteSpeed).
To confirm a version is fixed, check its changelog (for example):
rpm -q --changelog alt-php82-common | grep -E 'CVE-2026-(109618|109619)'
Oct 21, 2026 - 22:29 UTC
To install them, add the repository and update alt-php using the steps below. CloudLinux OS 10 already receives alt-php from this repository and only needs a regular update.
CloudLinux OS 7, 8 and 9
1. Make sure the server is registered with CLN (this file must exist):
ls /etc/sysconfig/rhn/jwt.token || rhnreg_ks --activationkey <YOUR-KEY> --force
2. CloudLinux OS 8, 9 only: make sure cloudlinux-release is recent enough to provide the ELS ALT PHP repository package (8.10-16 or newer on CloudLinux OS 8, 9.8-3 or newer on CloudLinux OS 9).
Otherwise, the next step fails with No match for argument: els-php-release.
Update it and check the version; the update may need to run more than once to reach the latest version:
dnf update -y cloudlinux-release
rpm -q cloudlinux-release
3. Add the ELS ALT PHP repository:
CloudLinux OS 7: yum install -y els-php-release
CloudLinux OS 8, 9: dnf install -y els-php-release
4. Keep regular updates working even if the repository becomes unreachable:
CloudLinux OS 7: yum-config-manager --save --setopt=php-els.skip_if_unavailable=true
CloudLinux OS 8, 9: dnf config-manager --save --setopt=php-els.skip_if_unavailable=True
5. Check access to the repository (the output must include "Metadata cache created"):
CloudLinux OS 7: yum --disablerepo='*' --enablerepo=php-els makecache
CloudLinux OS 8, 9: dnf --disablerepo='*' --enablerepo=php-els makecache
6. Update alt-php:
CloudLinux OS 7: yum update -y 'alt-php*'
CloudLinux OS 8, 9: dnf upgrade -y 'alt-php*'
CloudLinux OS 10
Run a regular update:
dnf upgrade -y 'alt-php*'
After updating, restart your PHP services (Apache, PHP-FPM or LiteSpeed).
To confirm a version is fixed, check its changelog (for example):
rpm -q --changelog alt-php82-common | grep -E 'CVE-2026-(109618|109619)'
Oct 21, 2026 - 22:29 UTC
Update - Correction:
Our 19:00 UTC update said the first fixed CloudLinux alt-php packages were released.
Those packages went to the TuxCare ELS alt-php repository. CloudLinux 7, 8, and 9 servers install alt-php from the CloudLinux repositories, where the fixed packages are not available yet.
CloudLinux 10 servers install alt-php from the TuxCare ELS repository, and fixed alt-php 7.4 is confirmed there. Fixed ea-php packages for cPanel EasyApache 4, ea-php52 through ea-php85, are released. Imunify360 rulesets 8.84 and 8.85 add blocking rules, including on LiteSpeed.
Full details: https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619
Oct 21, 2026 - 21:59 UTC
Our 19:00 UTC update said the first fixed CloudLinux alt-php packages were released.
Those packages went to the TuxCare ELS alt-php repository. CloudLinux 7, 8, and 9 servers install alt-php from the CloudLinux repositories, where the fixed packages are not available yet.
CloudLinux 10 servers install alt-php from the TuxCare ELS repository, and fixed alt-php 7.4 is confirmed there. Fixed ea-php packages for cPanel EasyApache 4, ea-php52 through ea-php85, are released. Imunify360 rulesets 8.84 and 8.85 add blocking rules, including on LiteSpeed.
Full details: https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619
Oct 21, 2026 - 21:59 UTC
Update - Patched ea-php packages have been released to the stable repository for all versions from ea-php52 through ea-php85. Fixed versions (elX = el7, el8, el9 or el10):
- ea-php52: 5.2.17-27.elX.cloudlinux.67
- ea-php53: 5.3.29-29.elX.cloudlinux.69
- ea-php54: 5.4.45-82.elX.cloudlinux.9
- ea-php55: 5.5.38-64.elX.cloudlinux.10
- ea-php56: 5.6.40-25.elX.cloudlinux.18
- ea-php70: 7.0.33-29.elX.cloudlinux.17
- ea-php71: 7.1.33-20.elX.cloudlinux.17
- ea-php72: 7.2.34-12.elX.cloudlinux.18
- ea-php73: 7.3.33-15.elX.cloudlinux.18
- ea-php74: 7.4.33-18.elX.cloudlinux.13
- ea-php80: 8.0.30-11.elX.cloudlinux.1
- ea-php81: 8.1.34-4.elX.cloudlinux.1
- ea-php82: 8.2.34-2.elX.cloudlinux.1
- ea-php83: 8.3.35-2.elX.cloudlinux.2
- ea-php84: 8.4.26-2.elX.cloudlinux.1
- ea-php85: 8.5.11-2.elX.cloudlinux.1
To update, run:
yum clean all
yum update "ea-php*"
Then restart Apache and PHP-FPM:
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm
To confirm a version is fixed, check its PHP package, for example:
rpm -q ea-php71-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'
Oct 21, 2026 - 20:55 UTC
- ea-php52: 5.2.17-27.elX.cloudlinux.67
- ea-php53: 5.3.29-29.elX.cloudlinux.69
- ea-php54: 5.4.45-82.elX.cloudlinux.9
- ea-php55: 5.5.38-64.elX.cloudlinux.10
- ea-php56: 5.6.40-25.elX.cloudlinux.18
- ea-php70: 7.0.33-29.elX.cloudlinux.17
- ea-php71: 7.1.33-20.elX.cloudlinux.17
- ea-php72: 7.2.34-12.elX.cloudlinux.18
- ea-php73: 7.3.33-15.elX.cloudlinux.18
- ea-php74: 7.4.33-18.elX.cloudlinux.13
- ea-php80: 8.0.30-11.elX.cloudlinux.1
- ea-php81: 8.1.34-4.elX.cloudlinux.1
- ea-php82: 8.2.34-2.elX.cloudlinux.1
- ea-php83: 8.3.35-2.elX.cloudlinux.2
- ea-php84: 8.4.26-2.elX.cloudlinux.1
- ea-php85: 8.5.11-2.elX.cloudlinux.1
To update, run:
yum clean all
yum update "ea-php*"
Then restart Apache and PHP-FPM:
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm
To confirm a version is fixed, check its PHP package, for example:
rpm -q ea-php71-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'
Oct 21, 2026 - 20:55 UTC
Update - Fixed packages for the versions below are already available in our stable repositories. If you run any of them, please update now (a regular package update, e.g. `yum update alt-php*` / `apt upgrade`). Security advisory metadata (OVAL/VEX/UpdateInfo) will follow — until it is published, security-only update filters (`yum --security`, `dnf updateinfo`) will not list these packages.
ALT-PHP — fixed versions available now
• CloudLinux / AlmaLinux 8, 9: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux / AlmaLinux 10: 5.6, 7.4, 8.4
• CloudLinux 7: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux 6: 5.2, 5.6, 7.4, 8.0
• Ubuntu 18.04, 20.04, 22.04, 24.04: 5.2, 5.6, 7.4, 8.4
• Ubuntu 26.04: 5.6, 7.4, 8.4 · Ubuntu 16.04: 5.6, 7.4
• Debian 10, 11: 5.6, 7.4, 8.0, 8.4
• Debian 12: 5.6, 7.4, 8.0, 8.1, 8.3, 8.4
• Debian 13: 5.2–5.6, 7.4, 8.0, 8.1, 8.3, 8.4
• Alpine 3.23, 3.24: 7.3, 8.0, 8.1
Remaining alt-php versions are rolling out continuously; the bulk is expected by ~21:15 UTC, alt-php 8.5 by ~22:30 UTC.
TuxCare ELS / ESU — distribution PHP fixed and available now
RHEL 7, Oracle Linux 6 and 7, CentOS 8.4, CentOS 8.5, CentOS Stream 8, Amazon Linux 2, AlmaLinux 9.2 ESU, AlmaLinux 9.8 ESU, TuxCare 9.6 ESU, TuxCare 9.8 ESU, Ubuntu 16.04 / 18.04 / 20.04 ELS, Alpine 3.18 ELS
Releasing now: CloudLinux 7, Debian 11 ELS
Next: CentOS 6, CentOS 7, Debian 10 ELS, PHP for Windows
Interim protection: Imunify360 ModSecurity ruleset 8.84 (stable) blocks the known exploit pattern; servers with Imunify360 WAF enabled receive it automatically.
We will post an update every 30 minutes until all packages are released.
Oct 21, 2026 - 20:18 UTC
ALT-PHP — fixed versions available now
• CloudLinux / AlmaLinux 8, 9: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux / AlmaLinux 10: 5.6, 7.4, 8.4
• CloudLinux 7: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux 6: 5.2, 5.6, 7.4, 8.0
• Ubuntu 18.04, 20.04, 22.04, 24.04: 5.2, 5.6, 7.4, 8.4
• Ubuntu 26.04: 5.6, 7.4, 8.4 · Ubuntu 16.04: 5.6, 7.4
• Debian 10, 11: 5.6, 7.4, 8.0, 8.4
• Debian 12: 5.6, 7.4, 8.0, 8.1, 8.3, 8.4
• Debian 13: 5.2–5.6, 7.4, 8.0, 8.1, 8.3, 8.4
• Alpine 3.23, 3.24: 7.3, 8.0, 8.1
Remaining alt-php versions are rolling out continuously; the bulk is expected by ~21:15 UTC, alt-php 8.5 by ~22:30 UTC.
TuxCare ELS / ESU — distribution PHP fixed and available now
RHEL 7, Oracle Linux 6 and 7, CentOS 8.4, CentOS 8.5, CentOS Stream 8, Amazon Linux 2, AlmaLinux 9.2 ESU, AlmaLinux 9.8 ESU, TuxCare 9.6 ESU, TuxCare 9.8 ESU, Ubuntu 16.04 / 18.04 / 20.04 ELS, Alpine 3.18 ELS
Releasing now: CloudLinux 7, Debian 11 ELS
Next: CentOS 6, CentOS 7, Debian 10 ELS, PHP for Windows
Interim protection: Imunify360 ModSecurity ruleset 8.84 (stable) blocks the known exploit pattern; servers with Imunify360 WAF enabled receive it automatically.
We will post an update every 30 minutes until all packages are released.
Oct 21, 2026 - 20:18 UTC
Update - New fixed packages have been released:
- alt-php80 for EL 7, EL 8
- php-8.0.30 for AlmaLinux 9.2 ESU
Oct 21, 2026 - 18:22 UTC
- alt-php80 for EL 7, EL 8
- php-8.0.30 for AlmaLinux 9.2 ESU
Oct 21, 2026 - 18:22 UTC
Update - Update – Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619): WAF protection in place
The following protections were rolled out on Oct 21 (all times UTC):
- WAF ruleset 8.83 (09:08): blocks the known exploit request pattern and adds detection of exploit attempts.
- WAF ruleset 8.84 (13:07): blocks the publicly available exploit tool and additional exploit request patterns.
- WAF ruleset 8.85 (17:17): blocks further variants of the exploit tool and adds detection of related malformed upload requests.
- IP reputation (updated continuously): IP addresses that scan for or exploit these vulnerabilities get a CAPTCHA challenge on servers protected by Imunify360.
Rulesets are delivered automatically; no action is required. We still recommend updating PHP to a patched version as soon as one is available for your environment.
Oct 21, 2026 - 17:38 UTC
The following protections were rolled out on Oct 21 (all times UTC):
- WAF ruleset 8.83 (09:08): blocks the known exploit request pattern and adds detection of exploit attempts.
- WAF ruleset 8.84 (13:07): blocks the publicly available exploit tool and additional exploit request patterns.
- WAF ruleset 8.85 (17:17): blocks further variants of the exploit tool and adds detection of related malformed upload requests.
- IP reputation (updated continuously): IP addresses that scan for or exploit these vulnerabilities get a CAPTCHA challenge on servers protected by Imunify360.
Rulesets are delivered automatically; no action is required. We still recommend updating PHP to a patched version as soon as one is available for your environment.
Oct 21, 2026 - 17:38 UTC
Update - New fixed packages have been released:
- alt-php74 for EL9, Ubuntu 20.04
- alt-php80 for EL 6, Alpine Linux 3.24, Debian 10, Debian 11
- alt-php81 for Alpine Linux 3.23, Alpine Linux 3.24
- php-8.0.30 for TuxCare 9.6 ESU
Oct 21, 2026 - 17:29 UTC
- alt-php74 for EL9, Ubuntu 20.04
- alt-php80 for EL 6, Alpine Linux 3.24, Debian 10, Debian 11
- alt-php81 for Alpine Linux 3.23, Alpine Linux 3.24
- php-8.0.30 for TuxCare 9.6 ESU
Oct 21, 2026 - 17:29 UTC
Update - New fixed packages have been released:
- php-7.4.6 for CentOS 8.4 ELS
- php-7.0.33 for Ubuntu 16.04 ELS
- php-7.2.24-0 for Ubuntu 18.04 ELS
- alt-php80 for Alpine Linux 3.23
Oct 21, 2026 - 16:46 UTC
- php-7.4.6 for CentOS 8.4 ELS
- php-7.0.33 for Ubuntu 16.04 ELS
- php-7.2.24-0 for Ubuntu 18.04 ELS
- alt-php80 for Alpine Linux 3.23
Oct 21, 2026 - 16:46 UTC
Update - Fixed alt-php74 are released for EL 8, Debian 11, Ubuntu 16.04, Ubuntu 24.04 and Ubuntu 26.04
Fixed php-7.4.19 released for CentOS 8.5 ELS
Oct 21, 2026 - 16:08 UTC
Fixed php-7.4.19 released for CentOS 8.5 ELS
Oct 21, 2026 - 16:08 UTC
Update - Fixed alt-php74 is already released for EL6, EL7, EL10, Debian 10, Ubuntu 18.04 and Ubuntu 22.04
Oct 21, 2026 - 15:36 UTC
Oct 21, 2026 - 15:36 UTC
Update - Critical PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619): updates in progress
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical vulnerabilities (CVSS 9.2) that allow unauthenticated remote code execution:
- CVE-2026-109618: memory corruption when PHP runs out of memory while handling specially crafted multipart (form or upload) requests.
- CVE-2026-109619: internal data left over from an earlier request can be reused after its memory is freed, for example through session upload progress handling.
Apache mod_php carries the highest risk. PHP-FPM, LiteSpeed and FrankenPHP are affected in some configurations.
What we're doing:
- CloudLinux alt-php: We are preparing patched builds for all alt-php versions, from 5.2 through 8.5. We expect to release them within approximately 5 hours. We will update this page when they are available.
- cPanel ea-php: Patched ea-php74 through ea-php85 packages are scheduled for release in EasyApache4 v25.91.
- TuxCare ELS: Patched PHP packages for supported ELS operating systems are in testing and will be released as they complete validation.
- Imunify360: WAF rules that detect attempts to exploit these vulnerabilities have been deployed.
What you should do:
- Apply PHP updates as soon as they are available (yum update / apt upgrade) and restart your PHP services: Apache, PHP-FPM or LSAPI.
- Until then, you can reduce (but not remove) the risk by setting session.upload_progress.enabled=0 in php.ini or the FPM pool configuration, then restarting PHP.
We will post updates here as packages are published.
Oct 21, 2026 - 14:55 UTC
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical vulnerabilities (CVSS 9.2) that allow unauthenticated remote code execution:
- CVE-2026-109618: memory corruption when PHP runs out of memory while handling specially crafted multipart (form or upload) requests.
- CVE-2026-109619: internal data left over from an earlier request can be reused after its memory is freed, for example through session upload progress handling.
Apache mod_php carries the highest risk. PHP-FPM, LiteSpeed and FrankenPHP are affected in some configurations.
What we're doing:
- CloudLinux alt-php: We are preparing patched builds for all alt-php versions, from 5.2 through 8.5. We expect to release them within approximately 5 hours. We will update this page when they are available.
- cPanel ea-php: Patched ea-php74 through ea-php85 packages are scheduled for release in EasyApache4 v25.91.
- TuxCare ELS: Patched PHP packages for supported ELS operating systems are in testing and will be released as they complete validation.
- Imunify360: WAF rules that detect attempts to exploit these vulnerabilities have been deployed.
What you should do:
- Apply PHP updates as soon as they are available (yum update / apt upgrade) and restart your PHP services: Apache, PHP-FPM or LSAPI.
- Until then, you can reduce (but not remove) the risk by setting session.upload_progress.enabled=0 in php.ini or the FPM pool configuration, then restarting PHP.
We will post updates here as packages are published.
Oct 21, 2026 - 14:55 UTC
Identified - The releases for alt-php are already in progress. The ea-php is also proceeding to release soon
We plan to release fixes for alt-php and ea-php by 19:00 UTC. Maximum effort is currently being made to get this done sooner.
alt-php74 is already released for EL6 and EL10
Oct 21, 2026 - 14:39 UTC
We plan to release fixes for alt-php and ea-php by 19:00 UTC. Maximum effort is currently being made to get this done sooner.
alt-php74 is already released for EL6 and EL10
Oct 21, 2026 - 14:39 UTC
Update - The Imunify360 ModSecurity ruleset 8.83 is now in the Stable channel. It contains a blocking rule for the publicly circulating exploit shape for CVE-2026-109618 / CVE-2026-109619, which targets the PHP session upload progress handling of multipart requests, plus a telemetry rule to track related activity. Servers with Imunify360 and its WAF (ModSecurity) enabled receive the ruleset automatically, no action is needed. Attempts matching this pattern are already being observed, and additional heuristic rules are being prepared.
This is an interim mitigation, not a complete fix: the underlying issue is broader than the multipart upload path. The PHP security release is still scheduled for today, 21 October 2026, 14:00 UTC. Work on updated alt-php packages with the fix is in progress, we will share the timeline in the next update.
Optional partial hardening until the patch is applied: disabling the session upload progress feature in php.ini (session.upload_progress.enabled = Off). This closes only one of the known paths and does not fully mitigate the vulnerability. Applications that display upload progress bars via this feature will lose that functionality.
Oct 21, 2026 - 09:26 UTC
This is an interim mitigation, not a complete fix: the underlying issue is broader than the multipart upload path. The PHP security release is still scheduled for today, 21 October 2026, 14:00 UTC. Work on updated alt-php packages with the fix is in progress, we will share the timeline in the next update.
Optional partial hardening until the patch is applied: disabling the session upload progress feature in php.ini (session.upload_progress.enabled = Off). This closes only one of the known paths and does not fully mitigate the vulnerability. Applications that display upload progress bars via this feature will lose that functionality.
Oct 21, 2026 - 09:26 UTC
Investigating - The PHP Security Team has announced an upcoming security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical).
Technical details and affected versions are scheduled to be disclosed at that time.
We will post updates here as more information becomes available.
Official announcement:
https://www.php.net/archive/2026.php#2026-10-20-1
Oct 20, 2026 - 21:00 UTC
It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical).
Technical details and affected versions are scheduled to be disclosed at that time.
We will post updates here as more information becomes available.
Official announcement:
https://www.php.net/archive/2026.php#2026-10-20-1
Oct 20, 2026 - 21:00 UTC
Update - Fixed kernels and livepatch coverage by CloudLinux version:
- CloudLinux 7h and 8: the bridge fix (CVE-2026-53266) is in 4.18.0-553.142.1.lve and newer. The kernel with the crypto fix (CVE-2025-39964) is in staged rollout, and its version will be added when it reaches stable.
- CloudLinux 9: the current kernel carries the TLS and bridge fixes (bridge fix from 5.14.0-687.23.1.el9_8). The kernel with the crypto fix is in preparation.
- CloudLinux 10: 6.12.0-211.59.1.el10_2 or newer carries all three fixes.
- CloudLinux 8 LTS and 9 LTS: the bridge fix is in kernel-lts-5.14.0-284.1101.tuxcare.11.els13 and newer. The crypto and TLS fixes are in preparation.
KernelCare livepatches are live for CloudLinux 7h, 8, 9 LTS and 10, and for the TLS and bridge flaws on CloudLinux 9. The crypto livepatch for CloudLinux 9 is in preparation. CloudLinux 8 LTS has no livepatch on this kernel line, so it needs the kernel update and a reboot.
Check all three CVEs on a KernelCare server:
kcarectl --patch-info | grep -E 'CVE-2025-39964|CVE-2026-53266|CVE-2025-39682'
Full per-version table in the blog article.
Oct 22, 2026 - 05:25 UTC
- CloudLinux 7h and 8: the bridge fix (CVE-2026-53266) is in 4.18.0-553.142.1.lve and newer. The kernel with the crypto fix (CVE-2025-39964) is in staged rollout, and its version will be added when it reaches stable.
- CloudLinux 9: the current kernel carries the TLS and bridge fixes (bridge fix from 5.14.0-687.23.1.el9_8). The kernel with the crypto fix is in preparation.
- CloudLinux 10: 6.12.0-211.59.1.el10_2 or newer carries all three fixes.
- CloudLinux 8 LTS and 9 LTS: the bridge fix is in kernel-lts-5.14.0-284.1101.tuxcare.11.els13 and newer. The crypto and TLS fixes are in preparation.
KernelCare livepatches are live for CloudLinux 7h, 8, 9 LTS and 10, and for the TLS and bridge flaws on CloudLinux 9. The crypto livepatch for CloudLinux 9 is in preparation. CloudLinux 8 LTS has no livepatch on this kernel line, so it needs the kernel update and a reboot.
Check all three CVEs on a KernelCare server:
kcarectl --patch-info | grep -E 'CVE-2025-39964|CVE-2026-53266|CVE-2025-39682'
Full per-version table in the blog article.
Oct 22, 2026 - 05:25 UTC
Update - The KernelCare livepatch for the crypto flaw (CVE-2025-39964) on CloudLinux 7 has been on the main feed since October 9. Subscribed servers take it on their next update cycle, or you can apply it now with no reboot:
kcarectl --update
The CloudLinux 7 livepatch for the bridge flaw is still in final release.
Oct 13, 2026 - 16:03 UTC
kcarectl --update
The CloudLinux 7 livepatch for the bridge flaw is still in final release.
Oct 13, 2026 - 16:03 UTC
Update - The KernelCare livepatch for the crypto flaw (CVE-2025-39964) on CloudLinux 7 has reached the testing feed. Servers on the default feed do not have it yet. To take it from the testing feed:
kcarectl --update --prefix test
Once the patch reaches the main feed, subscribed servers take it on their next update cycle. This advisory will be updated then. The CloudLinux 7 livepatch for the bridge flaw is still in final release.
Oct 09, 2026 - 19:43 UTC
kcarectl --update --prefix test
Once the patch reaches the main feed, subscribed servers take it on their next update cycle. This advisory will be updated then. The CloudLinux 7 livepatch for the bridge flaw is still in final release.
Oct 09, 2026 - 19:43 UTC
Identified - On September 18, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue: CVE-2025-39964 (a crypto-socket flaw), CVE-2026-53266 (a bridge-firewall flaw), and CVE-2025-39682 (a kernel-TLS flaw). They are three separate bugs in different parts of the kernel. Fixing one has nothing to do with the others.
Which versions each one affects is in the affected table. In short: the crypto flaw affects every CloudLinux version; the bridge flaw affects every version but is reachable by an ordinary account only on some; the TLS flaw affects only CloudLinux 8 LTS, 9, 9 LTS, and 10.
The three flaws:
CVE-2025-39964, the crypto-socket flaw: a public exploit escalates an ordinary account to root. → details
CVE-2026-53266, the bridge-firewall flaw: memory corruption or privilege escalation, reachable by an ordinary account only where private network spaces are open. → details
CVE-2025-39682, the kernel-TLS flaw: can leak kernel memory or crash the machine on affected systems. → details
Two fix routes: a KernelCare livepatch applies with no reboot where one is available; otherwise the fix is a kernel update and reboot. The fix-status table gives both routes per version, and the update instructions carry the streams.
Check whether a server is patched → How to verify
How the bugs work → Technical details
Oct 07, 2026 - 12:48 UTC
Which versions each one affects is in the affected table. In short: the crypto flaw affects every CloudLinux version; the bridge flaw affects every version but is reachable by an ordinary account only on some; the TLS flaw affects only CloudLinux 8 LTS, 9, 9 LTS, and 10.
The three flaws:
CVE-2025-39964, the crypto-socket flaw: a public exploit escalates an ordinary account to root. → details
CVE-2026-53266, the bridge-firewall flaw: memory corruption or privilege escalation, reachable by an ordinary account only where private network spaces are open. → details
CVE-2025-39682, the kernel-TLS flaw: can leak kernel memory or crash the machine on affected systems. → details
Two fix routes: a KernelCare livepatch applies with no reboot where one is available; otherwise the fix is a kernel update and reboot. The fix-status table gives both routes per version, and the update instructions carry the streams.
Check whether a server is patched → How to verify
How the bugs work → Technical details
Oct 07, 2026 - 12:48 UTC
Infinity Core (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775): six kernel core bugs with public PoCs, KernelCare status
Subscribe
Update - We are continuing to work on a fix for this issue.
Oct 21, 2026 - 09:17 UTC
Oct 21, 2026 - 09:17 UTC
Update - We are continuing to work on a fix for this issue.
Oct 21, 2026 - 09:16 UTC
Oct 21, 2026 - 09:16 UTC
Update - CVE-2026-80775 livepatch for AlmaLinux 9 and CloudLinux 9 is now in the ePortal feed.
- K20261014_0019, ePortal feed since 2026-10-20 07:13 UTC.
Ubuntu 26.04 livepatches for CVE-2026-98260, CVE-2026-98256, CVE-2026-89754 and CVE-2026-80775 are in final review.
- Not released yet.
CVE-2026-98260 livepatch for EL9 and EL10 is in progress.
- Not released yet.
Estimate unchanged: first releases in the test feed on Thursday 2026-10-22 and in the production feed on Friday 2026-10-23.
Vendors:
- Red Hat fixed CVE-2026-98260 and CVE-2026-98256 in the general RHEL 10 kernel: RHSA-2026:85321, kernel 6.12.0-211.67.1.el10_2. RHEL 9 is still without a fix for CVE-2026-98260.
- Ubuntu: CVE-2026-98256 and CVE-2026-80775 do not affect 24.04. Fix for 26.04 still pending.
No public exploit change. Still no reports of exploitation in the wild.
To check a server:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'
Oct 20, 2026 - 23:29 UTC
- K20261014_0019, ePortal feed since 2026-10-20 07:13 UTC.
Ubuntu 26.04 livepatches for CVE-2026-98260, CVE-2026-98256, CVE-2026-89754 and CVE-2026-80775 are in final review.
- Not released yet.
CVE-2026-98260 livepatch for EL9 and EL10 is in progress.
- Not released yet.
Estimate unchanged: first releases in the test feed on Thursday 2026-10-22 and in the production feed on Friday 2026-10-23.
Vendors:
- Red Hat fixed CVE-2026-98260 and CVE-2026-98256 in the general RHEL 10 kernel: RHSA-2026:85321, kernel 6.12.0-211.67.1.el10_2. RHEL 9 is still without a fix for CVE-2026-98260.
- Ubuntu: CVE-2026-98256 and CVE-2026-80775 do not affect 24.04. Fix for 26.04 still pending.
No public exploit change. Still no reports of exploitation in the wild.
To check a server:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'
Oct 20, 2026 - 23:29 UTC
Identified - CVE-2026-80775 (futex) is already livepatched on AlmaLinux 9 and CloudLinux 9.
- K20261014_0019, general kernel up to 5.14.0-687.54.1.el9_8, production feed since 2026-10-16 07:20 UTC. Not in the ePortal feed yet.
First releases for the remaining CVEs: rough estimate is the test feed on Thursday 2026-10-22 and the production feed on Friday 2026-10-23.
This first release covers only part of the exploitable set. Which CVE and distribution pairs it covers is not known yet.
Correction: five of the six public PoCs give root, not four. The fifth is CVE-2026-98385 on kernel 7.2. No supported kernel carries it.
Vendors:
- Red Hat: CVE-2026-98260 affects RHEL 9 and 10. Fixed kernels exist only for some EUS and SAP streams (9.2, 9.4, 9.6, 10.0), not for the general RHEL 9 and 10 kernel yet.
- Red Hat: CVE-2026-80775 fixed for RHEL 9 (RHSA-2026:74438), RHEL 10 affected, no fix yet.
- Red Hat: CVE-2026-98256 affects RHEL 10. RHEL 9 not affected.
- Red Hat: CVE-2026-89754 does not affect RHEL 6 to 10.
- Debian fixed CVE-2026-98260: bookworm 6.1.190-1 (DLA-4841-1), trixie 6.12.113-1 (DSA-6568-1). A kernel update plus reboot closes it there.
- Ubuntu: CVE-2026-98260 fix pending for 24.04 and 26.04, no fixed kernel yet.
Scope changes, not verified by our own tests:
- CVE-2026-98256 and CVE-2026-80775 also reach EL10, according to Red Hat.
- Our first analysis listed them for Ubuntu 26.04 only.
- CVE-2026-89754 is also handled for Debian 13.
No report of exploitation in the wild.
To check a server:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'
Oct 19, 2026 - 20:52 UTC
- K20261014_0019, general kernel up to 5.14.0-687.54.1.el9_8, production feed since 2026-10-16 07:20 UTC. Not in the ePortal feed yet.
First releases for the remaining CVEs: rough estimate is the test feed on Thursday 2026-10-22 and the production feed on Friday 2026-10-23.
This first release covers only part of the exploitable set. Which CVE and distribution pairs it covers is not known yet.
Correction: five of the six public PoCs give root, not four. The fifth is CVE-2026-98385 on kernel 7.2. No supported kernel carries it.
Vendors:
- Red Hat: CVE-2026-98260 affects RHEL 9 and 10. Fixed kernels exist only for some EUS and SAP streams (9.2, 9.4, 9.6, 10.0), not for the general RHEL 9 and 10 kernel yet.
- Red Hat: CVE-2026-80775 fixed for RHEL 9 (RHSA-2026:74438), RHEL 10 affected, no fix yet.
- Red Hat: CVE-2026-98256 affects RHEL 10. RHEL 9 not affected.
- Red Hat: CVE-2026-89754 does not affect RHEL 6 to 10.
- Debian fixed CVE-2026-98260: bookworm 6.1.190-1 (DLA-4841-1), trixie 6.12.113-1 (DSA-6568-1). A kernel update plus reboot closes it there.
- Ubuntu: CVE-2026-98260 fix pending for 24.04 and 26.04, no fixed kernel yet.
Scope changes, not verified by our own tests:
- CVE-2026-98256 and CVE-2026-80775 also reach EL10, according to Red Hat.
- Our first analysis listed them for Ubuntu 26.04 only.
- CVE-2026-89754 is also handled for Debian 13.
No report of exploitation in the wild.
To check a server:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'
Oct 19, 2026 - 20:52 UTC
Investigating - On October 16, 2026 a researcher published six Linux kernel bugs under the name Infinity Core, with public proof-of-concept code for all six oss-security disclosure, PoCs and write-ups. Every bug starts from an ordinary unprivileged local user. Upstream fixes exist for all of them and there are no reports of exploitation in the wild.
Five of the PoCs (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775, the fifth is for Arch Linux and is outside of scope) give root. They were written and tested on Ubuntu 26.04. On the other distributions only CVE-2026-98260 (POSIX CPU timer use-after-free) is confirmed so far, and only as a kernel crash. Escalation to root there is not ruled out. The other two bugs (CVE-2026-98385, CVE-2026-97941) exist only in kernel 7.2 and later, so no kernel we support carries them.
Affected:
- Ubuntu 26.04: root with CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775
- AlmaLinux 9 and 10, CloudLinux 9 and 10, Debian 12, Debian 13, Ubuntu 24.04: crash with CVE-2026-98260
- CloudLinux 7, 8 and other distributions: assessment in progress
We are also still checking whether CVE-2026-80775 reaches EL9.
Mitigation: Debian already ships fixed kernels for CVE-2026-98260: Debian 12 6.1.190-1 (DLA-4841-1), Debian 13 6.12.113-1 (DSA-6568-1). Kernel update plus reboot closes the gap there. For other distros, there are no workarounds that we can recommend currently. Since the bugs sit in exec(), signal, mincore() and futex code that every system uses, there is no module to block and no sysctl that removes the trigger.
Fix status: KernelCare livepatches are in preparation. CVE-2026-98260 comes first, on all the affected distributions, then the four root bugs on Ubuntu 26.04. No ETA yet.
Once a livepatch is on your feed, apply with:
kcarectl --update
And verify by running:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'
This incident will be updated as livepatches reach the testing and main feeds.
Oct 19, 2026 - 14:21 UTC
Five of the PoCs (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775, the fifth is for Arch Linux and is outside of scope) give root. They were written and tested on Ubuntu 26.04. On the other distributions only CVE-2026-98260 (POSIX CPU timer use-after-free) is confirmed so far, and only as a kernel crash. Escalation to root there is not ruled out. The other two bugs (CVE-2026-98385, CVE-2026-97941) exist only in kernel 7.2 and later, so no kernel we support carries them.
Affected:
- Ubuntu 26.04: root with CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775
- AlmaLinux 9 and 10, CloudLinux 9 and 10, Debian 12, Debian 13, Ubuntu 24.04: crash with CVE-2026-98260
- CloudLinux 7, 8 and other distributions: assessment in progress
We are also still checking whether CVE-2026-80775 reaches EL9.
Mitigation: Debian already ships fixed kernels for CVE-2026-98260: Debian 12 6.1.190-1 (DLA-4841-1), Debian 13 6.12.113-1 (DSA-6568-1). Kernel update plus reboot closes the gap there. For other distros, there are no workarounds that we can recommend currently. Since the bugs sit in exec(), signal, mincore() and futex code that every system uses, there is no module to block and no sysctl that removes the trigger.
Fix status: KernelCare livepatches are in preparation. CVE-2026-98260 comes first, on all the affected distributions, then the four root bugs on Ubuntu 26.04. No ETA yet.
Once a livepatch is on your feed, apply with:
kcarectl --update
And verify by running:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'
This incident will be updated as livepatches reach the testing and main feeds.
Oct 19, 2026 - 14:21 UTC
Update - CVE-2026-99999 (CVSS 9.3 Critical) is a flaw in how the Linux kernel handles IPv4 checksum metadata from virtio-net. An untrusted virtual machine (VM) guest can overwrite two bytes of an already-validated IPv4 header on the host. The researcher reports a host memory leak, a host crash, and code execution as root on a test host.
No public proof-of-concept exists, and we have not reproduced the attack.
Affected: every supported CloudLinux kernel line is expected to carry the vulnerable code. Hosts that run untrusted VM guests are exposed on every version. Shared hosts without VMs are exposed only where unprivileged users can create user namespaces.
Mitigation: partial and untested. Turn off checksum offload for untrusted guests, and disable unprivileged user namespaces to close the local path.
Fix status: no fixed kernel has shipped yet.
Stream 1, CloudLinux kernel (CloudLinux 7h, 8): in preparation, waiting for the upstream fix.
Stream 2, AlmaLinux kernel (CloudLinux 9, 10): waiting for the AlmaLinux fix.
Stream 3, TuxCare ELS kernel (CloudLinux 8 LTS, 9 LTS): pending ELS release.
Stream 4, KernelCare livepatch: EL9 family released:
K20261016_0001: RHEL 9 - in testing
K20261016_0002: AlmaLinux 9 and CloudLinux 9 - currently in the main feed
K20261016_0004: Oracle Linux 9 - in testing
K20261016_0005 / K20261016_0006: Rocky Linux 9 - in testing
Patchsets for other systems still in progress.
Verify: uname -r against the target version, or kcarectl --patch-info | grep CVE-2026-99999
You can find more detailed information on our blog: CVE-2026-99999
Oct 16, 2026 - 17:34 UTC
No public proof-of-concept exists, and we have not reproduced the attack.
Affected: every supported CloudLinux kernel line is expected to carry the vulnerable code. Hosts that run untrusted VM guests are exposed on every version. Shared hosts without VMs are exposed only where unprivileged users can create user namespaces.
Mitigation: partial and untested. Turn off checksum offload for untrusted guests, and disable unprivileged user namespaces to close the local path.
Fix status: no fixed kernel has shipped yet.
Stream 1, CloudLinux kernel (CloudLinux 7h, 8): in preparation, waiting for the upstream fix.
Stream 2, AlmaLinux kernel (CloudLinux 9, 10): waiting for the AlmaLinux fix.
Stream 3, TuxCare ELS kernel (CloudLinux 8 LTS, 9 LTS): pending ELS release.
Stream 4, KernelCare livepatch: EL9 family released:
K20261016_0001: RHEL 9 - in testing
K20261016_0002: AlmaLinux 9 and CloudLinux 9 - currently in the main feed
K20261016_0004: Oracle Linux 9 - in testing
K20261016_0005 / K20261016_0006: Rocky Linux 9 - in testing
Patchsets for other systems still in progress.
Verify: uname -r against the target version, or kcarectl --patch-info | grep CVE-2026-99999
You can find more detailed information on our blog: CVE-2026-99999
Oct 16, 2026 - 17:34 UTC
Update - KernelCare livepatch is currently available in the test feed for the EL9 family and will be released to the main feed later today.
K20261016_0001: RHEL 9
K20261016_0002: AlmaLinux 9 and CloudLinux 9
K20261016_0004: Oracle Linux 9
K20261016_0005 / K20261016_0006: Rocky Linux 9
Oct 16, 2026 - 11:21 UTC
K20261016_0001: RHEL 9
K20261016_0002: AlmaLinux 9 and CloudLinux 9
K20261016_0004: Oracle Linux 9
K20261016_0005 / K20261016_0006: Rocky Linux 9
Oct 16, 2026 - 11:21 UTC
Identified - A vulnerability exists in the Linux kernel’s IPv4 networking code that could allow a malicious virtual machine guest to damage memory within the host kernel by sending specially crafted packets. Remote network access alone is insufficient to exploit this flaw; the attacker must already be able to execute code inside a VM or on the server. Systems running KVM with untrusted virtual machines face the greatest risk.
At this time, no publicly available exploit code has been identified. Technical details have been published in a write-up, and there are no known reports of exploitation in the wild.
Status:
- Upstream fix exists. Red Hat has not published its assessment or a fix yet.
- We decided not to wait for the vendor here. KernelCare patch is in progress (KCARE-32844), no ETA yet
Affected distros/kernels:
CentOS7 3.10 - Vulnerable
Debian12 6.1 - Vulnerable
Debian13 6.12 - Vulnerable
Ubuntu24.04 6.8 - Vulnerable
Ubuntu26.04 7.0 - Vulnerable
Almalinux8 4.18 - Local Privilege Escalation Possible
Almalinux9 5.14 - Local Privilege Escalation Possible
Almalinux10 6.12 - Local Privilege Escalation Possible
Oct 15, 2026 - 23:02 UTC
At this time, no publicly available exploit code has been identified. Technical details have been published in a write-up, and there are no known reports of exploitation in the wild.
Status:
- Upstream fix exists. Red Hat has not published its assessment or a fix yet.
- We decided not to wait for the vendor here. KernelCare patch is in progress (KCARE-32844), no ETA yet
Affected distros/kernels:
CentOS7 3.10 - Vulnerable
Debian12 6.1 - Vulnerable
Debian13 6.12 - Vulnerable
Ubuntu24.04 6.8 - Vulnerable
Ubuntu26.04 7.0 - Vulnerable
Almalinux8 4.18 - Local Privilege Escalation Possible
Almalinux9 5.14 - Local Privilege Escalation Possible
Almalinux10 6.12 - Local Privilege Escalation Possible
Oct 15, 2026 - 23:02 UTC
Update - The KernelCare livepatch for CloudLinux 9 LTS is on the main feed. Subscribed servers take it on their next update cycle. Coverage for CloudLinux 7 is still to be confirmed.
Oct 14, 2026 - 16:02 UTC
Oct 14, 2026 - 16:02 UTC
Update - The patched CloudLinux 7h and CloudLinux 8 kernels are in the stable channel. The staged rollout completed on October 6, 2026, so the standard update path now installs them on every server: run yum update 'kernel*' and reboot. After the reboot, uname -r should report 4.18.0-553.157.1.lve.2.el8 on CloudLinux 8 or 4.18.0-553.157.1.lve.2.el7h on CloudLinux 7h.
Oct 07, 2026 - 16:09 UTC
Oct 07, 2026 - 16:09 UTC
Update - Patched CloudLinux 8 LTS and CloudLinux 9 LTS kernels carrying the fix are in the beta channel: kernel-lts-5.14.0-284.1101.el8.tuxcare.11.els14 on CloudLinux 8 LTS and kernel-lts-5.14.0-284.1101.el9.tuxcare.11.els14 on CloudLinux 9 LTS. Promotion to the stable channel follows on the normal schedule, and this section will be updated when it lands.
Oct 02, 2026 - 20:15 UTC
Oct 02, 2026 - 20:15 UTC
Update - The patched CloudLinux 7h and CloudLinux 8 kernels have moved out of beta. A staged rollout to the stable channel began on September 23, 2026, so servers on the stable channel pick the update up progressively rather than all at once. Target versions are unchanged: kernel-4.18.0-553.157.1.lve.2.el8 and kernel-4.18.0-553.157.1.lve.2.el7h.
To install now rather than wait for the rollout to reach your server, use the beta-channel commands below and reboot. Once the rollout completes, the standard yum update 'kernel*' followed by a reboot is enough.
Sep 24, 2026 - 20:00 UTC
To install now rather than wait for the rollout to reach your server, use the beta-channel commands below and reboot. Once the rollout completes, the standard yum update 'kernel*' followed by a reboot is enough.
Sep 24, 2026 - 20:00 UTC
Update - KernelCare livepatches for CloudLinux 7h and CloudLinux 8 are on the main feed. The CloudLinux 7h patch covers the kernel 4.18.0-553.157.1.lve.2.el7h. Subscribed servers take them on their next update cycle.
Sep 23, 2026 - 19:42 UTC
Sep 23, 2026 - 19:42 UTC
Update - Status summary as of September 23, 2026
CloudLinux 7:
Patch under assessment. Not exposed to ordinary accounts by default.
CloudLinux 7h and CloudLinux 8 (exposed by default):
Fixed kernel 4.18.0-553.157.1.lve.2 is in the beta channel; KernelCare livepatch is on the testing feed kcarectl --update --prefix test.
Stable/main-feed release will follow the normal schedule.
CloudLinux 8 LTS (exposed by default):
Patched kernel in preparation. KernelCare does not cover this kernel line. Keep the modprobe mitigation in place until the fixed kernel ships.
CloudLinux 9:
KernelCare livepatch on the main feed kernel 5.14.0-687.46.1.el9_8.
Not exposed to ordinary accounts by default.
CloudLinux 9 LTS:
Patch in preparation. Not exposed to ordinary accounts by default.
CloudLinux 10: KernelCare livepatch on the main feed kernel 6.12.0-211.53.1.el10_2.
Not exposed to ordinary accounts by default.
Verify a KernelCare-patched server with:
kcarectl --patch-info | grep CVE-2026-72389
Full details and mitigation instructions: https://blog.cloudlinux.com/bridge-stp-uaf-cve-2026-72389-kernel-update-cloudlinux
Sep 22, 2026 - 23:05 UTC
CloudLinux 7:
Patch under assessment. Not exposed to ordinary accounts by default.
CloudLinux 7h and CloudLinux 8 (exposed by default):
Fixed kernel 4.18.0-553.157.1.lve.2 is in the beta channel; KernelCare livepatch is on the testing feed kcarectl --update --prefix test.
Stable/main-feed release will follow the normal schedule.
CloudLinux 8 LTS (exposed by default):
Patched kernel in preparation. KernelCare does not cover this kernel line. Keep the modprobe mitigation in place until the fixed kernel ships.
CloudLinux 9:
KernelCare livepatch on the main feed kernel 5.14.0-687.46.1.el9_8.
Not exposed to ordinary accounts by default.
CloudLinux 9 LTS:
Patch in preparation. Not exposed to ordinary accounts by default.
CloudLinux 10: KernelCare livepatch on the main feed kernel 6.12.0-211.53.1.el10_2.
Not exposed to ordinary accounts by default.
Verify a KernelCare-patched server with:
kcarectl --patch-info | grep CVE-2026-72389
Full details and mitigation instructions: https://blog.cloudlinux.com/bridge-stp-uaf-cve-2026-72389-kernel-update-cloudlinux
Sep 22, 2026 - 23:05 UTC
Update - KernelCare livepatches for CloudLinux 7h and CloudLinux 8 have reached the testing feed. The CloudLinux 7h patch covers kernel 4.18.0-553.157.1.lve.2.el7h. Servers on the default feed do not have these yet; to take one from the testing feed now:
kcarectl --update --prefix test
Sep 22, 2026 - 23:05 UTC
kcarectl --update --prefix test
Sep 22, 2026 - 23:05 UTC
Update - The KernelCare livepatch for CloudLinux 10 is on the main feed and covers the CloudLinux 10 kernel 6.12.0-211.53.1.el10_2. Subscribed servers take it on their next update cycle. Livepatches for CloudLinux 7h and CloudLinux 8 are still in preparation.
Sep 19, 2026 - 04:00 UTC
Sep 19, 2026 - 04:00 UTC
Update - The KernelCare livepatch for CloudLinux 9 is now on the main feed, covering kernel 5.14.0-687.46.1.el9_8. Subscribed servers receive it automatically on the next update cycle, or immediately with kcarectl --update; verify with kcarectl --patch-info | grep CVE-2026-72389.
Sep 15, 2026 - 23:51 UTC
Sep 15, 2026 - 23:51 UTC
Identified - bridge-stp-uaf (CVE-2026-72389, CVSS 7.0, Moderate per Red Hat) is a vulnerability in the Linux kernel’s bridge Spanning Tree Protocol timers. A local unprivileged user who can configure a network bridge can turn it into root on the host. The researchers published helper code rather than a working exploit, and none has appeared publicly since.
Affected: → Affected CloudLinux versions
CloudLinux 7h, CloudLinux 8 and CloudLinux 8 LTS, where an ordinary hosting account reaches the flaw as shipped.
The vulnerable code is in every CloudLinux kernel, but CloudLinux 7, 9, 9 LTS, 10 and CloudLinux for Ubuntu 22.04 are not exposed to ordinary accounts by default.
Mitigation: one modprobe rule that stops the bridge module from loading. No reboot on hosts that do not bridge. → Is there a mitigation?
Fix status → Update instructions
CloudLinux 7h and 8 kernel: patched kernels 4.18.0-553.157.1.lve.2 are in the beta channel; promotion to stable follows on the normal schedule. → Stream 1
AlmaLinux kernel (CloudLinux 9, 10): no fixed kernel yet. Red Hat lists its kernels as affected with no fix published, and AlmaLinux follows Red Hat. Both versions are not exposed by default. → Stream 2
CloudLinux 8 LTS and 9 LTS kernel (TuxCare ELS): in preparation. → Stream 3
KernelCare livepatch: in preparation. → Stream 4
Verify: uname -r against the target version in your stream; kcarectl –patch-info | grep CVE-2026-72389 once a livepatch ships. → How to verify you are patched
Why it matters: on a shared host the local user is whoever compromised one of your sites, and root on the kernel is root over every tenant. → Why this matters on a shared host
How the bug works: a topology-change timer can be armed on a bridge that is already down, and deleting the bridge frees it with the timer still queued. → Technical details of the bug
Sep 10, 2026 - 17:53 UTC
Affected: → Affected CloudLinux versions
CloudLinux 7h, CloudLinux 8 and CloudLinux 8 LTS, where an ordinary hosting account reaches the flaw as shipped.
The vulnerable code is in every CloudLinux kernel, but CloudLinux 7, 9, 9 LTS, 10 and CloudLinux for Ubuntu 22.04 are not exposed to ordinary accounts by default.
Mitigation: one modprobe rule that stops the bridge module from loading. No reboot on hosts that do not bridge. → Is there a mitigation?
Fix status → Update instructions
CloudLinux 7h and 8 kernel: patched kernels 4.18.0-553.157.1.lve.2 are in the beta channel; promotion to stable follows on the normal schedule. → Stream 1
AlmaLinux kernel (CloudLinux 9, 10): no fixed kernel yet. Red Hat lists its kernels as affected with no fix published, and AlmaLinux follows Red Hat. Both versions are not exposed by default. → Stream 2
CloudLinux 8 LTS and 9 LTS kernel (TuxCare ELS): in preparation. → Stream 3
KernelCare livepatch: in preparation. → Stream 4
Verify: uname -r against the target version in your stream; kcarectl –patch-info | grep CVE-2026-72389 once a livepatch ships. → How to verify you are patched
Why it matters: on a shared host the local user is whoever compromised one of your sites, and root on the kernel is root over every tenant. → Why this matters on a shared host
How the bug works: a topology-change timer can be armed on a bridge that is already down, and deleting the bridge frees it with the timer still queued. → Technical details of the bug
Sep 10, 2026 - 17:53 UTC
Update - CloudLinux 10 has a fixed kernel. AlmaLinux 10 kernel 6.12.0-211.65.1.el10_2 (ALSA-2026:81406) fixes both CVEs and is in the production repositories. To install it, run dnf update 'kernel*' and reboot. CloudLinux 9 has no fixed kernel yet. Red Hat released its RHEL 9 fix on October 13, and we’ll add the AlmaLinux 9 kernel version here when it’s out.
Oct 14, 2026 - 16:02 UTC
Oct 14, 2026 - 16:02 UTC
Update - Red Hat now lists the RHEL 8 kernel as not affected by either CVE-2026-64507 or CVE-2026-64508. This matches our analysis of the CloudLinux 7h and 8 kernels: no update is needed for these versions, and no fix is expected for them.
Oct 09, 2026 - 03:49 UTC
Oct 09, 2026 - 03:49 UTC
Update - The published attack doesn’t work on the CloudLinux 7h and 8 kernels, according to our analysis of their code, so no update is needed for these versions. Red Hat lists RHEL 8 as affected by CVE-2026-64507 and not affected by CVE-2026-64508. If Red Hat releases a fix for RHEL 8, CloudLinux 7h and 8 will pick it up once AlmaLinux 8 has it, and we’ll note it here.
Oct 07, 2026 - 12:34 UTC
Oct 07, 2026 - 12:34 UTC
Identified - BTR (CVE-2026-64507, CVE-2026-64508, Moderate per Red Hat) is a Spectre v2 variant that lets a local unprivileged user read kernel memory. It does not give root by itself. A public proof-of-concept exists for two Intel processor microarchitectures, and no exploitation in the wild has been reported.
Affected: every CloudLinux version except CloudLinux 7. → Affected CloudLinux versions
Processors: whether an attack can succeed also depends on the processor. The published exploit works on two Intel microarchitectures only. → Which processors are at risk
Mitigation: none. → Is there a mitigation?
Fix status: fixed upstream on July 25, 2026. Red Hat, AlmaLinux and Canonical haven’t released it yet. → Update instructions
CloudLinux 7h and 8 kernel: CloudLinux builds it once AlmaLinux 8 has the fix.
AlmaLinux kernel (CloudLinux 9, 10): follows Red Hat, which lists its kernels as affected and has released no fix yet.
LTS kernels (CloudLinux 8 LTS, 9 LTS): follow Red Hat’s release.
KernelCare livepatch: follows the vendor fixes.
CloudLinux for Ubuntu 22.04: the fix comes from Canonical, which hasn’t released it for 22.04 yet.
Why it matters: on a shared host, a compromised site is enough to run the attack. → Why this matters on a shared host
How the bug works: the processor keeps old branch predictions when the kernel reuses memory for a new filter program. → Technical details of the bug
Oct 05, 2026 - 16:10 UTC
Affected: every CloudLinux version except CloudLinux 7. → Affected CloudLinux versions
Processors: whether an attack can succeed also depends on the processor. The published exploit works on two Intel microarchitectures only. → Which processors are at risk
Mitigation: none. → Is there a mitigation?
Fix status: fixed upstream on July 25, 2026. Red Hat, AlmaLinux and Canonical haven’t released it yet. → Update instructions
CloudLinux 7h and 8 kernel: CloudLinux builds it once AlmaLinux 8 has the fix.
AlmaLinux kernel (CloudLinux 9, 10): follows Red Hat, which lists its kernels as affected and has released no fix yet.
LTS kernels (CloudLinux 8 LTS, 9 LTS): follow Red Hat’s release.
KernelCare livepatch: follows the vendor fixes.
CloudLinux for Ubuntu 22.04: the fix comes from Canonical, which hasn’t released it for 22.04 yet.
Why it matters: on a shared host, a compromised site is enough to run the attack. → Why this matters on a shared host
How the bug works: the processor keeps old branch predictions when the kernel reuses memory for a new filter program. → Technical details of the bug
Oct 05, 2026 - 16:10 UTC
About This Site
Welcome to CloudLinux status page. Here you can see if there are any ongoing issues with the CloudLinux network or other services.
CloudLinux OS Components
Operational
Alt-PHP
Operational
CageFS
Operational
MySQL Governor
Operational
EasyApache4 PHP packages
Operational
CloudLinux Kernel
Operational
Mod_lsapi
Operational
PHP Selector
Operational
Python Selector
Operational
Ruby Selector
Operational
Node.js Selector
Operational
CloudLinux Network
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance