We completed the deployment of the CloudLinux and cPanel security patches for the PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
As of October 21, 2026, at 19:31 Argentina time (22:31 UTC), the patches had been applied to all our servers. You don't need to install anything or change your service's PHP configuration: our team has already taken care of it.
Why was I still seeing the previous PHP version?
CloudLinux incorporated the security fixes into its existing versions using a procedure called backporting: it fixes vulnerabilities without necessarily changing the version number shown in cPanel, WordPress, or PHP.
Seeing the previous version number doesn't mean these patches are missing. Verification is performed by checking the full version of the installed package and its fix history. You can read CloudLinux's explanation in its official notice.
Can I verify the patches from SSH or the cPanel Terminal?
Our accounts use CageFS, which isolates each customer's environment. Within that environment, the rpm command isn't available.
If running it displays rpm: command not found, that's due to this restriction and doesn't indicate that the update is missing. Our team can check from the server administration panel and share the details for your service.
Do I need to do anything?
No. The patches have been applied across our entire infrastructure.
Keep your applications, plugins, and themes up to date.
If you're using an old version of PHP, we can help you plan an upgrade and review compatibility.
Our support team is available 24/7 to answer any questions.