Does Hawk Host protect against PHP CVE-2026-109618 and CVE-2026-109619?
On October 21, 2026, PHP released updates for two security vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
Web Hosting Plans
Section titled “Web Hosting Plans”PHP INI Changes
Section titled “PHP INI Changes”We’ve updated our PHP INI settings to mitigate these vulnerabilities where possible.
Imunify360 Protection
Section titled “Imunify360 Protection”Imunify360 released web application firewall rules to block known attack vectors for CVE-2026-109618 and CVE-2026-109619
Cloudflare Protection
Section titled “Cloudflare Protection”If you utilize Cloudflare, they have also deployed web application firewall rules to protect known attack vectors against CVE-2026-109618 and CVE-2026-109619
cPanel
Section titled “cPanel”cPanel has already been updated to protect itself against CVE-2026-109618 and CVE-2026-109619
alt-php status
Section titled “alt-php status”All alt-php* versions have been updated to protect against CVE-2026-109618 and CVE-2026-109619
ea-php status
Section titled “ea-php status”All ea-php** versions have been updated to protect against CVE-2026-109618 and CVE-2026-109619
Virtual Private Servers
Section titled “Virtual Private Servers”cPanel
Section titled “cPanel”cPanel has built updates packages for ea-php* versions to protect against CVE-2026-109618 and CVE-2026-109619. They are currently in a staggered release.
ea-php status
Section titled “ea-php status”CloudLinux has built packages for ea-php* versions to protect against CVE-2026-109618 and CVE-2026-109619
alt-php status
Section titled “alt-php status”CloudLinux has built packages for alt-php* versions to protect against CVE-2026-109618 and CVE-2026-109619
Other Panels
Section titled “Other Panels”For other panels please consult their documentation or support team.
Custom Panels / Installations
Section titled “Custom Panels / Installations”For custom panels or installations, please update your PHP version to the latest stable release with patches for CVE-2026-109618 and CVE-2026-109619.
Frequently Asked Questions
Section titled “Frequently Asked Questions”Will there be fixes for PHP versions older than 8.3?
Section titled “Will there be fixes for PHP versions older than 8.3?”On Hawk Host shared web hosting servers, we utilize CloudLinux. CloudLinux intends to release fixes for PHP versions that are end-of-life, including PHP 7.4.
What Versions is cPanel Updating with Fixes?
Section titled “What Versions is cPanel Updating with Fixes?”cPanel is updating the following versions with fixes for CVE-2026-109618 and CVE-2026-109619:
- ea-php74
- ea-php80
- ea-php81
- ea-php82
- ea-php83
- ea-php84
- ea-php85
Is there a timeline for when alt-php will be updated?
Section titled “Is there a timeline for when alt-php will be updated?”CloudLinux has been updating alt-php* throughout the day and has no official timeline for completion.