cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
Do Son 
TL;DR
cPanel has issued two security updates covering three CVEs. A cPanel PHP update fixes the critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, across EasyApache4 builds. Separately, WP Toolkit 6.11.5 fixes CVE-2026-107663, which lets one user plant files on another user’s domain.
- Product: PHP Group PHP
- Vulnerabilities: 2 flaws (CVE-2026-109618, CVE-2026-109619)
- Highest severity: 9.2 (Critical · CVSSv4)
- Worst impact: RCE via OOM corruption
- Status: 2 exploited; patches available
- Action: Update to 8.2.35, 8.3.36, 8.4.27, 8.5.12 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | RCE via OOM corruption | 8.2.35, 8.3.36, 8.4.27 (+1) | Exploited in the wild |
| CVE-2026-109619 | 9.2 | RCE via stale global state | 8.2.35, 8.3.36, 8.4.27 (+1) | Exploited in the wild |
Why It Matters
cPanel & WHM runs many shared hosting servers, where many sites often share one machine. One weak site or user can put every neighbor at risk. Meanwhile, Amazon reports that PHP2Shell “is now being broadly exploited in the wild.” That makes this cPanel PHP update urgent for every host.
How the Attacks Work
PHP2Shell
Both PHP bugs corrupt memory when a request ends abnormally, leading to code execution. According to the cPanel critical PHP security release notice, “all shipped PHP versions are suspected to be vulnerable.” Success “can allow remote code execution.”
WP Toolkit cross-domain file write
The cPanel WP Toolkit advisory for CVE-2026-107663 warns that “an authenticated user may be able to place malicious files in a domain owned by another user.” cPanel shares no further technical details.
Exploitation status
Attackers are exploiting PHP2Shell widely. However, no source reports attacks on the WP Toolkit flaw.
Affected Versions
- All supported cPanel & WHM versions
- EasyApache4 PHP 5.0 and later, on cPanel and CloudLinux
- WP Toolkit 6.11.4 and earlier
Patch and Mitigation Steps
- Update cPanel & WHM to 11.110.0.153, 11.134.0.66, 11.136.0.50 or 11.138.0.18.
- Update ea-php82 through ea-php85 to 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
- Patched builds also exist for ea-php74, ea-php80 and ea-php81.
- CloudLinux EasyApache4 users should install their backported builds, such as ea-php82 8.2.34-2.
- Upgrade WP Toolkit to 6.11.5 or later.
After updating, cPanel suggests checking each PHP build’s changelog for the CVE ID. Admins can also confirm the WP Toolkit version from the command line.
Hosting providers should apply this cPanel PHP update first, given the active attacks.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
