PHP CVE-2026-109618 and CVE-2026-109619¶
Everything you need to know¶
Affected PHP versions¶
- All versions 5.4 and later
- All 7.x versions
- All 8.0.x versions
- All 8.1.x versions
- Versions up to 8.2.34, 8.3.36, 8.4.27, and 8.5.12
Available patches¶
Patches are currently available for supported versions of Debian and Ubuntu (Ubuntu 22.04 and later, Debian 11 and later) for PHP 5.6 and later, including PHP 7, 8.0, and 8.1.
We are installing the patched versions automatically, so there is no need to submit a request. If we encounter any issues, we will contact you.
Other operating systems (unsupported versions)¶
It is very likely that we will be unable to install a patched PHP version on an unsupported OS release. Please consider upgrading your distribution.
Plesk¶
Plesk manages its own PHP versions, and in most cases, we cannot install patched versions from our own repositories.
You can check the patch status for Plesk servers at the link below.