[From the Blog] PHP CVE-2026-109618 and CVE-2026-109619: Our Response and What WHMCS Customers Need to Do

[WHMCS Community]

/images/whmcs_blog.png

On October 21, 2026, the PHP project released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. According to PHP, both vulnerabilities can allow unauthenticated remote code execution. This means an attacker could run code on a vulnerable server without logging in. Because WHMCS runs on PHP, these vulnerabilities may affect your WHMCS installation. The vulnerabilities are in PHP, not in the WHMCS code itself. In this post, we'll go over what the...

View the full blog post