# Source: PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

CloudLinux: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection

**CloudLinux** · [https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/](https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/) · published 2026-10-21T10:28:34+00:00 · added by `curator@php.newsroom` · slug `cloudlinux-wikipedia-ref-17-php-cve-2026-109618-and`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CloudLinux blog, 21 October, updated after the fixes: PHP CVE-2026-109618 and CVE-2026-109619, CloudLinux package status and Imunify360 protection. It...

## What it says, as the collector read it

#### PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `us/cloud/cloudlinux/wikipedia-ref-17-php-cve-2026-109618-and-cve-2026-109619`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

CloudLinux blog, 21 October, updated after the fixes: PHP CVE-2026-109618 and CVE-2026-109619, CloudLinux package status and Imunify360 protection. It restates PHP's advisory: two separate flaws, each allowing unauthenticated remote code execution (GHSA-w8hw-w9fx-j79w, out-of-memory handling; GHSA-6wmf-4rv5-p3rp, stale request state); the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP says updating is the only complete solution; the project gave advance notice on 20 October and CERT-EU also published an advisory. A hosting-vendor post, with an Imunify360 ruleset as an interim measure.

> PHP states that updating is the only complete solution.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection". Selected mechanically, not read by a person.

#### Capture notes

Language `en-US`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261025T114552Z · HTTP 200 · https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619- `headers.json` 53dda7d8fe42cc34e04c046fe89c65c2e513762c0cbc6a54a23a132a50733197 1,462 bytes
- `page.html` 8baf713eabc8d20f7658385113ab92e59b0053d57812a3906103c4478e262dbd 537,483 bytes
- `provenance.json` 886c818a9ba34776eaa509b8312171b635dce945c243c0c03e23bdd36d5fde4c 1,741 bytes
- `rendered.html` fa0ad6a66a6b3d6928bb6cbeaf281ef0e7ea32228acd4971a5eb2fea505f5d63 1,239,182 bytes
- `screenshot.jpg` d8d459d73952515f259844cfdfe4163110f9c0d1db8362e48a5379f7585b4c58 774,928 bytes
- `text.txt` 7b6cc3009fb6ee2e90456e46675809cd7bd3c1c8a9c41dea283e77656fa12bfc 24,117 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/cloudlinux-wikipedia-ref-17-php-cve-2026-109618-and/index.html