cPanel & WHM Security Update

Updated internal PHP We updated cPanel & WHM’s internal PHP packages to address critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). This update affects PHP in cPanel interfaces, including Roundcube webmail. cPanel & WHM versions 138.0.18, 136.0.50, and 134.0.66 include PHP 8.4.27. cPanel & WHM version 110.0.153 includes backported security fixes for PHP 8.1.34. For a full list of changes, visit the cPanel & WHM change logs and select your version.