Update: patched PHP builds are now available
The patched PHP builds for CVE-2026-109618 and CVE-2026-109619 are now published in the RunCloud package repository for these stacks:
- Native (NGINX / NGINX + Apache): available.
- OpenLiteSpeed / LiteSpeed Enterprise: available.
- Docker / Containerized: not available yet. We’re still waiting on patched builds and will post here as soon as they’re out.
Patched builds roll out to your servers on PHP 8.2 and newer automatically, so you don’t need to do anything. The rollout isn’t instant, so if you want to apply the patch immediately, please keep reading:
Want the patch right now?
If you’d rather not wait for the automatic rollout, you can install it yourself on a Native, OpenLiteSpeed or LiteSpeed Enterprise server.
Connect to the server over SSH as root (or a user with sudo) and run:
apt update && apt upgrade -y
Warning: this upgrades every package on the server that has an update waiting, not only PHP. Services such as PHP-FPM and your web server restart during the upgrade, which can briefly interrupt your sites. Run it at a quiet time and make sure you have a recent backup first. If you’re not comfortable doing this, wait for the automatic rollout.
A separate update for containerized servers will follow.
About the dashboard today
The RunCloud dashboard and API were interrupted several times today while we pushed the patched builds out. Both are back up now.
Still in place
- The temporary mitigation (session.upload_progress disabled) stays active on all servers.
- If any of your web applications still run PHP 8.1 or older, switch them to PHP 8.2 or newer from the dashboard. Those versions won’t receive an official fix, and the patched builds above don’t cover them.
What’s next
We’ll follow up tomorrow with a detailed write-up of what happened today, including the dashboard interruptions. We’ll also post here as soon as patched builds for containerized servers are available.
Thank you for your patience. We know today has been disruptive, and we appreciate you bearing with us. We took preventative measures to ensure that both our and, by extension, your infrastructure were as protected as they could be.
If you have any questions, please open a ticket in your dashboard or email [email protected] from the email address associated with your account. The support team can see which servers you have and which stack each one runs, so they can give you the most specific answer.