October 23, 2026 — Rad Web Hosting is pleased to announce the successful deployment of critical security patches addressing CVE-2026-109618 and CVE-2026-109619 across its entire fleet of managed cPanel & WHM servers.
Following the disclosure of two critical vulnerabilities affecting the PHP scripting engine on October 21, 2026, Rad Web Hosting prioritized the deployment of the applicable vendor-provided security updates throughout its managed hosting infrastructure.
These vulnerabilities, collectively referred to as PHP2Shell, could potentially allow an unauthenticated attacker to achieve remote code execution (RCE) under certain conditions.
Given the severity of these vulnerabilities and the widespread use of PHP in web hosting environments, our infrastructure management team treated these updates as a high-priority security maintenance operation.
We can confirm that the necessary patches have now been applied across all Rad Web Hosting-managed cPanel servers.
Understanding the Vulnerabilities
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect how PHP handles certain memory operations during HTTP request processing.
Both vulnerabilities are considered critical due to their potential to permit remote code execution, which could allow an attacker to run unauthorized commands within the security context of an affected PHP process.
CVE-2026-109618 — Memory Corruption During Request Processing
This vulnerability involves improper memory handling when PHP encounters a memory allocation failure during the processing of HTTP requests.
Under certain conditions, PHP may attempt to access or clean up partially initialized memory structures, potentially resulting in memory corruption.
Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on an affected server, depending on the PHP configuration and execution environment.
CVE-2026-109619 — Improper Handling of Internal Request State
This vulnerability involves PHP retaining references to internal request data after the associated memory has been released.
Under specific circumstances, subsequent requests processed by the same PHP worker may interact with this stale state, creating the potential for memory corruption and remote code execution.
Because PHP is widely used by content management systems, e-commerce platforms, hosting control panels, and web applications, vulnerabilities affecting its core execution environment require immediate attention.
Security Patches Successfully Deployed
In response to the vendor security advisories, Rad Web Hosting initiated a coordinated update operation across its managed cPanel infrastructure.
The maintenance addressed two primary components of the hosting environment:
1. cPanel & WHM Internal PHP Components
Security updates were applied to address vulnerabilities affecting the internal PHP runtime used by cPanel & WHM interfaces and associated applications, including Roundcube webmail.
See Also: How to Configure Additional Firewall Rules on Rocky Linux VPS (5 Minute Guide)
These updates incorporate the security corrections supplied through the official cPanel release channels.
2. EasyApache 4 PHP Packages
Applicable security updates were also deployed to the EasyApache 4 PHP packages responsible for executing customer websites and PHP-based applications.
The updates address the underlying memory-handling vulnerabilities in affected PHP releases.
Where vendor-maintained PHP branches incorporate backported security corrections, the applicable patched packages provide protection without necessarily requiring an upgrade to a newer PHP major version.
This distinction is particularly important for hosting environments that rely on application compatibility with specific PHP versions.
Our Managed Infrastructure Security Response
Rad Web Hosting maintains an ongoing security maintenance program designed to identify, assess, and respond to newly disclosed vulnerabilities affecting its managed infrastructure.
Our response to CVE-2026-109618 and CVE-2026-109619 reflects this commitment.
The security maintenance effort focused on:
- Prioritized Patch Deployment: Addressing the critical vulnerabilities promptly following the availability of official vendor security packages.
- Infrastructure-Wide Coverage: Applying the appropriate security updates across all managed cPanel hosting servers.
- Control Panel Protection: Updating relevant cPanel & WHM components, including the internal PHP runtime.
- Website Runtime Protection: Deploying applicable EasyApache 4 PHP security updates to address vulnerabilities affecting hosted PHP applications.
- Compatibility Considerations: Utilizing vendor-supported security releases and backported fixes where applicable to minimize unnecessary software compatibility changes.
- Continued Security Oversight: Maintaining ongoing vulnerability monitoring and routine patch management as part of our managed hosting operations.
Security vulnerabilities affecting widely deployed software components require coordinated, timely remediation. By centrally managing server maintenance, Rad Web Hosting can deploy important security fixes without requiring individual hosting customers to administer the underlying operating system or control panel.
What This Means for Our Customers
Customers utilizing Rad Web Hosting’s fully managed cPanel hosting services do not need to manually install these particular security updates.
The applicable patches have already been deployed as part of our managed server maintenance program.
Customers can continue accessing their hosting accounts, websites, databases, email services, and cPanel interfaces as usual.
This update does not require customers to modify their website code, reinstall their content management systems, or independently upgrade their PHP applications solely to address these two vulnerabilities.
However, customers should continue maintaining their own application-level security by keeping WordPress installations, plugins, themes, and other third-party applications updated.
While the PHP security patches address the underlying vulnerabilities described in this advisory, they do not replace the need for regular application maintenance, strong authentication practices, and responsible website administration.
See Also: How to Install Mailwizz on cPanel VPS Server
Our Commitment to Proactive Security
At Rad Web Hosting, infrastructure security is a fundamental component of the managed hosting experience.
The rapid evolution of security threats requires more than simply deploying reliable hardware and high-performance hosting platforms. It requires ongoing vigilance, timely software maintenance, and an operational commitment to protecting customer environments.
Our managed hosting services are designed to reduce the administrative burden placed on customers while providing professionally maintained infrastructure.
Through ongoing system monitoring, security updates, and coordinated vulnerability remediation, we strive to maintain a secure, dependable hosting environment for businesses, developers, and organizations relying on our services.
The successful completion of these critical PHP security updates underscores our commitment to maintaining the security and integrity of our managed hosting infrastructure.
Frequently Asked Questions
Were Rad Web Hosting-managed cPanel servers affected by these vulnerabilities?
The vulnerabilities were identified in PHP components used by cPanel-based hosting environments. Rad Web Hosting responded by deploying the applicable vendor-provided security patches across all managed cPanel servers to address the exposure.
Have the vulnerabilities been patched?
Yes. The applicable security patches for CVE-2026-109618 and CVE-2026-109619 have been deployed across our managed cPanel server fleet.
Do I need to update PHP manually?
No. Customers using our fully managed cPanel hosting services do not need to manually update server-managed PHP packages for these vulnerabilities.
Will this affect my website or application compatibility?
The security maintenance was designed to address the vulnerabilities through vendor-supplied updates, including security backports where appropriate. Customers should continue to monitor their own applications for compatibility issues following routine software maintenance.
Does this mean my website was compromised?
No. The existence of a vulnerability does not mean that a website or server was compromised. Patch deployment is a preventative security measure and does not, by itself, establish whether previous exploitation occurred.
Are unmanaged servers included?
This announcement applies specifically to Rad Web Hosting-managed cPanel servers. Customers operating self-managed or unmanaged hosting environments remain responsible for applying the necessary security updates unless their service agreement explicitly includes managed patching.
What should I do if I have additional security concerns?
Customers may contact Rad Web Hosting’s technical support team through the client area for assistance with questions regarding their hosting environment.
Additional Information and Official References
For further technical information regarding these vulnerabilities and the corresponding security updates, please consult the following official resources:
- cPanel Security Advisory: https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619
- CVE-2026-109618: https://www.cve.org/CVERecord?id=CVE-2026-109618
- CVE-2026-109619: https://www.cve.org/CVERecord?id=CVE-2026-109619
Security Maintenance Status: Completed
All Rad Web Hosting-managed cPanel servers have received the applicable patches addressing CVE-2026-109618 and CVE-2026-109619.
See Also: What’s Your Safe Word?
No additional action is required from customers using our fully managed hosting services.
Rad Web Hosting will continue monitoring vendor security advisories and maintaining its managed infrastructure in accordance with established security maintenance practices.
Thank you for choosing Rad Web Hosting and trusting us with your hosting infrastructure.
Rad Web Hosting
Reliable Hosting. Innovative Cloud. Radically Better Service.
