On October 21, 2026, the PHP project released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. According to PHP, both vulnerabilities can allow unauthenticated remote code execution. This means an attacker could run code on a vulnerable server without logging in.

Because WHMCS runs on PHP, these vulnerabilities may affect your WHMCS installation. The vulnerabilities are in PHP, not in the WHMCS code itself.

In this post, we'll go over what the vulnerabilities involve, how we've responded, and next steps for you:

The PHP project has rated both vulnerabilities as Critical and released the fixes as previously communicated.

• CVE-2026-109618: This vulnerability affects how PHP handles running out of memory. PHP can be interrupted while internal request data is only partially set up, causing the cleanup process to treat invalid data as valid.
• CVE-2026-109619: This vulnerability allows internal request data to remain in use after the memory behind it has been freed. As a result, a later request handled by the same PHP worker may attempt to use that data.

According to PHP, any PHP installation serving web requests could be affected. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

• PHP 8.5: Patch available. Fixed in 8.5.12.
• PHP 8.4: Patch available. Fixed in 8.4.27.
• PHP 8.3: Patch available. Fixed in 8.3.36.
• PHP 8.2: Patch available. Fixed in 8.2.35.
• PHP 8.1 and earlier: No update from the PHP project. See "If you run PHP 8.1 or earlier" below.

PHP 8.1 and earlier no longer receive updates from the PHP project. However, the project has published source patches for PHP 7.4, 8.0, and 8.1 that vendors can use to build their own fixes.
This means your Linux distribution or hosting provider may offer a patched package even if your reported PHP version hasn't changed. If you're using a vendor-supplied package, check the vendor's security notice to confirm that the fix is included.
We've taken the following steps to help customers understand the vulnerabilities and take the necessary action.

• Advance notice: Before PHP released the updates, we emailed customers about the expected releases. We asked them to identify their servers and PHP versions, prepare to apply operating system updates, and brief their teams if a maintenance window would be needed.
• Confirmed the source of the vulnerabilities: We confirmed that both vulnerabilities are in PHP, not in the WHMCS code.
• WHMCS Cloud: We automatically patch Cloud WHMCS servers without downtime. If you're a WHMCS Cloud customer, you don't need to take any action.
• Customer guidance: This post outlines the fixed PHP versions and walks you through checking and updating your own server.

If you run WHMCS on a server you own or lease, install the relevant PHP security updates as soon as possible.

If your hosting provider manages your server, contact them to confirm that they're applying the necessary PHP updates.

Here's how to check your PHP version, apply the appropriate updates, and make sure your WHMCS installation is up to date.
In your WHMCS Admin Area, go to Utilities > System > PHP Info. This page shows the PHP version your installation uses.

Keep the following points in mind:

• If you use cPanel: You can also review the PHP versions on your server in WHM under Home > Software > MultiPHP Manager.
• If your vendor supplies PHP packages: Some packages include the security fix without changing the PHP version number. Check your vendor's security notice to confirm that the fix has been installed.
• If your cron uses a different PHP version: Your WHMCS cron job may run on a different PHP version from your website. See Resolve a Cron PHP Mismatch for guidance.

The steps you need to take depend on the PHP version you're currently running.

If you run PHP 8.2, 8.3, or 8.4Update to the fixed release for your current PHP version, or a later release within the same version series:

• PHP 8.2: 8.2.35
• PHP 8.3: 8.3.36
• PHP 8.4: 8.4.27

This is a patch update within your existing PHP version series, rather than an upgrade to a new major or minor version.

After updating, restart your PHP processes, such as PHP-FPM or Apache, if your update process doesn't restart them automatically. Then, revisit PHP Info to confirm the version you're running.

If you run PHP 8.1 or earlier
Upgrade to a PHP version supported by your WHMCS version that includes the fix.

• WHMCS 9.1: PHP 8.2, 8.3, or 8.4
• WHMCS 9.0: PHP 8.2 or 8.3
• WHMCS 8.13: PHP 8.2 or 8.3

Unlike a patch update, moving to a new PHP version is an upgrade and requires a little more preparation.

Before making the change, check that your ionCube Loader version and any custom or third-party code are compatible with the new PHP version. Test the upgrade before applying it to your production environment.

For more information, see PHP Upgrades and System Requirements.

One more thing to consider: PHP 8.2 reaches end of life on December 31, 2026. Choosing a later supported PHP version gives you more time before your next upgrade.
If you can't upgrade yet (WHMCS 8.13 only)
WHMCS 9.0 and later require PHP 8.2 or higher. If you're running WHMCS 8.13 on an older PHP version and can't upgrade PHP immediately, you have two options:

• Check with your hosting provider or Linux distribution. Ask whether they offer a fixed package for your current PHP version.
• Consider PHP Extended Lifecycle Support (ELS). If you manage your own server, ELS provides security-patched builds of older PHP versions after the PHP project stops supporting them.

ELS applies only to specific PHP versions and environments. It covers PHP only and doesn't replace the need to move to a supported PHP version.

For more information, see the ELS guides for cPanel and Plesk.
A WHMCS update won't fix these PHP vulnerabilities, but recent WHMCS releases fix security issues in WHMCS itself. Install the latest release for your version now.

Install the latest release available for your WHMCS version:

• WHMCS 9.1: 9.1.0
• WHMCS 9.0: 9.0.9
• WHMCS 8.13: 8.13.7
• WHMCS 8.12 or earlier: End of life. See Updating Through EOL Versions.

To check for an update, go to Utilities > Update WHMCS and click Check Now.

Updates will appear only if your PHP version meets the requirements for the new WHMCS release.

Before updating, back up your database and files.

For guidance, see Prepare to Update WHMCS.

The latest release for your current version is enough to complete this step. If you can, we recommend upgrading to WHMCS 9.1. If you do, make sure ionCube Loader 15.0.0 is installed first.
Your main web server may not be the only place PHP is running.

Rebuild your container images and check any other tools that include their own copy of PHP. These environments may need to be updated separately.
Updating PHP is the only complete fix. If you can't apply the update immediately, the PHP project's advisory lists temporary measures that can reduce exposure. These measures don't make an installation safe.The recommended measures include:

• Disable session upload progress: Set session.upload_progress.enabled=0 in your php.ini, PHP-FPM pool, or server configuration, then restart every PHP worker. Don't rely on ini_set() or .user.ini to apply this setting.
• Limit request sizes: Set a low post_max_size and enforce request size limits at your web server or proxy.

Before changing any settings, review the full PHP advisory for the complete list of recommendations.
On October 23, the PHP project published a further notice about a related issue, CVE-2026-115560.
The project recommends keeping session.upload_progress.enabled=0 until its next regular bugfix release, even on PHP versions that include the October 21 fixes.

If you've already applied this setting, keep it in place.
Taking the steps outlined above will help you address these PHP vulnerabilities and keep your WHMCS environment up to date.

We'll continue to share updates as more information becomes available.

If you have questions or need further guidance, please submit a ticket to our support team.

If you need to make changes to PHP on a server you manage, your hosting provider or system administrator can help.