Will WHMCS launch an update to path the critical PHP CVEs?

[Grapes]

Hello.

As you may be aware, on Oct. 21st, 2 high-risk CVEs were published for PHP (CVE-2026-109618 and CVE-2026-109619). Since these CVEs are quite critical, I want to know if WHMCS will launch an update or if we just need to update PHP on our server.

I was unable to find any publication or disclosure on the WHMCS blog, news posts, or channels. Just making sure we are not changing settings around or updating stuff when it's not needed.

[WHMCS SamP]

Hi there,

CVE-2026-109618 and CVE-2026-109619 are vulnerabilities in the PHP interpreter itself, not in WHMCS. No WHMCS code is affected, and no WHMCS patch is required. The remediation is entirely at the PHP level, so this must be addressed by you or your hosting provider through PHP updates.

Impact

Any server running an affected PHP version may be vulnerable regardless of the application being hosted. Therefore, you should consider your WHMCS server affected until the underlying PHP installation has been updated.

What you need to do

Please update to the patched PHP version for your branch as soon as your operating system vendor, control panel provider (for example cPanel EA-PHP, CloudLinux, Plesk), or package repository makes the update available.

After updating PHP, be sure to restart any relevant services, such as PHP-FPM, Apache, or Nginx, as appropriate for your environment.

While no WHMCS changes or updates are required to mitigate these vulnerabilities, updating PHP is required. Please work with your server administrator or hosting provider to ensure that all affected PHP versions on your server are updated as soon as practical.

Feel free to contact us if you have any questions or concerns.