PHP CVE-2026-109618 and CVE-2026-109619: check your PHP version !

[WHMCS Carlos]

Hi everyone,

We emailed licence holders about this on 21 October, the day PHP shipped the fixes, and again on 28 October. The full write-up went on the blog today. The forum is the last place I can put it in front of you, so here it is again.

On 21 October PHP fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution. They are in PHP itself, not in WHMCS code, which is why there is no WHMCS patch for them.

That last part is the bit I want to be careful about. "No WHMCS patch needed" does not mean nothing to do. If your server is running an unpatched PHP, your WHMCS install is sitting on it.

Three things, in order:

1. Check what PHP you are actually on. Utilities > System > PHP Info. Then check that your WHMCS cron runs on the same PHP version as the web server. On a lot of installs it does not, and the cron one gets forgotten.
2. Update PHP. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Restart PHP-FPM or Apache afterwards, then go back to PHP Info and confirm it took. If you are on 8.1 or older there is no upstream release, so you need a patched package from your host or your distribution. If someone else runs your server, ask them to confirm they have done it. Do not assume.
3. Update WHMCS. This does not fix the PHP flaws, nothing in WHMCS can. It fixes separate WHMCS security issues, which is its own reason to do it. Current releases are 9.1.0, 9.0.9 and 8.13.7. 8.12 and earlier are end of life and are not getting security fixes.

WHMCS Cloud customers: we patched this automatically, with no downtime. Nothing for you to do.

If you genuinely cannot patch today, set

session.upload_progress.enabled=0

in php.ini or your FPM pool and restart every worker. ini_set() and .user.ini do not count here. On 23 October PHP published a related issue, CVE-2026-115560, and the guidance is to leave that setting off until the next bugfix release even once you are patched.

The full write-up, including which PHP versions each WHMCS release supports and the rest of the mitigations, is here:
https://blog.whmcs.com/133799/php-cve-2026-109618-and-cve-2026-109619-our-response-and-what-whmcs-customers-need-to-do

If something specific is blocking you from patching, open a ticket, or reply here and I will pick it up.

Carlos