[Security] Critical PHP RCE vulnerabilities — patched PHP versions unavailable i

Hello everyone,

The PHP development team has released an urgent security advisory on October 21, 2026, regarding two critical vulnerabilities:

- CVE-2026-109618
- CVE-2026-109619

Both vulnerabilities are rated CVSS v4.0 9.2, and active exploitation has been reported.

Official PHP announcement:
https://www.php.net/archive/2026.php

The patched versions are:

- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35

**The problem is that these patched versions are currently unavailable in CWP's PHP-FPM Selector.**

I have checked two production servers running AlmaLinux 8 and CWP.

The latest versions currently available to me through the selector are:

- PHP 8.5.9
- PHP 8.4.24

Older PHP branches are also available, but they do not provide a solution to these vulnerabilities.

Both servers are currently running PHP-FPM 8.4.24 for their websites, and I cannot select the patched PHP 8.4.27 release through CWP.

**There is also a separate concern regarding CWP's internal PHP installation.**

On both servers, I have confirmed:

`/usr/local/cwp/php71/bin/php -v`

Output:

`PHP 7.2.30 (cli) (built: Apr 29 2020)`

This PHP installation is used by CWP's internal PHP-FPM services, including `cwpsrv-phpfpm`.

PHP 7.2 has been end-of-life for several years. I understand that the applicability of these two newly disclosed CVEs to this older branch needs to be assessed separately, but the continued use of such an old PHP version raises security concerns.

Could the CWP team please clarify:

1. When will PHP 8.4.27 and PHP 8.5.12 become available in the PHP-FPM Selector?
2. Is there an officially supported way to install these security releases immediately, without manually modifying CWP's configuration or breaking existing websites?
3. Does CWP's internal PHP 7.2.30 include vendor-maintained security backports, or is an upgrade planned?
4. Has the CWP team assessed whether its internal PHP components are affected by CVE-2026-109618 and CVE-2026-109619?
5. What immediate protective measures does CWP recommend until patched PHP versions are available?

Given the severity of the vulnerabilities and the lack of patched versions in the current selector, official guidance would be greatly appreciated.

Thank you!

Also concerned about this, but very doubtful that CWP will come up with a timely solution.

I already started running parallel tests with Cloudpanel and Cyberpanel, both of which have a much faster update cycle.

Feeling like my days of loyalty to CWP are numbered

To avoid having multiple threads discussing the same topic, I suggest continuing the discussion here:

https://forum.centos-webpanel.com/php/update-your-php-asap-128680/msg54460/?topicseen#msg54460

By the way, where are my friends @overseer and @starburst? 😊

It would be great to hear your thoughts on this topic as well.

Let's keep everything in one place so we can share information and updates more easily. Thanks, everyone!