PHP has now released emergency security fixes for CVE-2026-109618 and CVE-2026-109619, confirming that both critical vulnerabilities can allow unauthenticated remote code execution (RCE). Updated EasyDCIM and Remote Agent container images are already available and include PHP 8.3.36 with the official fixes.
EasyDCIM update available now: We recommend updating every EasyDCIM and Remote Agent server as soon as possible. The updated containers use PHP 8.3.36, which includes fixes for both critical vulnerabilities. The EasyDCIM Client Area does not use PHP and is not affected.
This article follows our earlier security notice about the critical PHP vulnerabilities. At that time, the PHP security team had announced an emergency release but had not yet published the technical details or fixed versions.
That information is now available, and the situation is much clearer.
What PHP has now confirmed
On October 21, 2026, PHP published security releases addressing CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities are rated 9.2 out of 10 under CVSS v4.0 and can result in unauthenticated remote code execution.
The vulnerabilities affect PHP’s internal memory handling while processing web requests:
- CVE-2026-109618 involves memory corruption triggered by out-of-memory conditions during request processing.
- CVE-2026-109619 involves stale global state that can survive between requests and lead to use-after-free conditions.
Successful exploitation may allow an unauthenticated attacker to execute code with the privileges of the PHP web worker.
PHP has released the following patched versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP explicitly states that there is no complete configuration-based mitigation for these vulnerabilities. Temporary hardening measures may reduce exposure to particular attack paths, but installing a patched PHP release is the only complete solution.
The urgency is no longer theoretical. Security providers have already reported attack traffic targeting the disclosed vulnerabilities following their publication.
For the official PHP security information and release announcements, see the PHP project announcements.
EasyDCIM update is now available!
Updated container images for the EasyDCIM application and Remote Agents are now available. They include PHP 8.3.36, which contains the official fixes for CVE-2026-109618 and CVE-2026-109619.
If you operate EasyDCIM, we recommend applying the update as soon as possible.
Run the following commands as root.
1. Update EasyDCIM Control
Run this on every EasyDCIM and Remote Agent server:
apt-get update
apt-get install --only-upgrade easydcim-control2. Update the EasyDCIM application
Run this on the main EasyDCIM application server:
easydcim-control app update3. Update Remote Agents
Run this on each Remote Agent server:
easydcim-control agent update4. Verify the PHP version
After completing the update, verify the PHP version inside the EasyDCIM containers:
docker exec easydcim_app php -v
docker exec easydcim_agent php -vBoth commands should report PHP 8.3.36.
EasyDCIM Client Area
The EasyDCIM Client Area does not use PHP and is therefore not affected by CVE-2026-109618 or CVE-2026-109619.
The security update described above applies to the PHP runtime used by the main EasyDCIM application and Remote Agents.
What about the temporary security precautions?
Before patched PHP builds were available, we recommended restricting public access to the EasyDCIM administration panel, Remote Agents, and API using a firewall, VPN, or IP allowlist.
Those measures remain good security practices, particularly for infrastructure management interfaces, but they should not be treated as a replacement for the update. Now that patched EasyDCIM images are available, installing them should be the priority.
Using EasyDCIM with WHMCS?
Updating EasyDCIM does not automatically update PHP on a separate WHMCS installation.
If WHMCS runs on another server, its PHP environment must be assessed and updated independently. PHP has released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
For environments using PHP 8.3, make sure you are running PHP 8.3.36 or newer. Always verify compatibility with your WHMCS version, ionCube Loader, PHP extensions, and installed third-party modules before changing the production runtime.
After updating PHP, test the most important WHMCS workflows, including:
- Client Area and Admin Area access
- order forms and checkout
- payment processing and invoice generation
- scheduled cron jobs
- service provisioning, suspension, and unsuspension
- communication between WHMCS and EasyDCIM
- EasyDCIM Dedicated Servers and Colocation module functions
Our previous security article contains a more detailed checklist for WHMCS administrators.
Older PHP environments require additional attention
PHP 8.1 and earlier branches are no longer supported by the PHP project through the normal release process. Some Linux distributions and long-term support vendors may provide backported security fixes.
If you operate other PHP-based systems alongside EasyDCIM and they still depend on an older branch, check with your operating system or LTS vendor immediately, or plan migration to a supported PHP release.
Update EasyDCIM now
The situation has moved quickly from an advance security warning to confirmed critical vulnerabilities with official fixes available.
EasyDCIM and Remote Agent container images with PHP 8.3.36 are now ready for deployment. We recommend updating all relevant EasyDCIM servers as soon as possible and verifying the PHP version afterward.
For general update procedures, you can also refer to the EasyDCIM Update Guide.
If you have any questions or encounter problems during the update, please contact our support team.