The past couple of months have been unusually busy on the security front. Serious vulnerabilities were disclosed in PHP, LiteSpeed Web Server and the Linux kernel, several with public exploits. Every one of them has been patched across all of our servers, and nothing further is required on your end. Below is a high-level rundown of what was fixed and what we did about it.
Critical PHP Vulnerabilities (php2shell)
All PHP versions we offer are fully patched against CVE-2026-109618 and CVE-2026-109619, the pair of PHP engine flaws nicknamed php2shell. Both are rated 9.2 (CVSS v4.0) and can let an attacker run code on a server without logging in. They have since been exploited in the wild, which made speed critical.
| Date | What we did |
|---|---|
| October 20 | Began monitoring as soon as the flaws were announced, and put interim mitigations in place through php.ini and Imunify360. |
| October 21 | Updated every server the moment CloudLinux published patched alt-php packages. CloudLinux backported the fixes into the existing versions, so version numbers did not change at first. |
| October 22 | Installed CloudLinux’s re-released alt-php packages, versioned to match PHP’s official fixes (8.2.35, 8.3.36, 8.4.27, 8.5.12). The code is identical to the earlier patched builds; only the reported version number changed. |
PHP 5.6 through 8.1 are no longer maintained by PHP directly, but they remain secured with CloudLinux’s backported patch. That said, if your site still runs one of these older versions, now is a great time to move to PHP 8.2 or newer.
LiteSpeed Web Server
All servers run the latest patched LiteSpeed Web Server Enterprise build. The most serious fixes target the account isolation that shared hosting depends on.
- CageFS bypass to root: a critical flaw flagged by cPanel in September, fixed in 6.3.7.
- LSQUIC: a critical vulnerability in the HTTP/3 library, fixed in 6.3.7 build 8.
- Apache configuration handling: under certain configurations, files outside a site’s document root could be accessed, or scripts run without suEXEC. On CageFS servers, the worst case was a CageFS escape to root. Fixed in v6.3.7 build 9.
Node.js
These fixes apply only if you run a Node.js application, such as one set up through cPanel’s Setup Node.js App.
- October 21 release (10 CVEs): the headline fix, CVE-2026-111497, is a Brotli decoder flaw that can allow remote code execution, and it is now known to be exploited. Fixed in 22.23.4, 24.22.1 and 26.12.1, and installed on all servers through CloudLinux’s alt-nodejs packages.
- November 11 release (16 CVEs): released on November 11, including CVE-2026-123864, an HTTPS flaw that can leak TLS private keys. Fixed upstream in 22.23.5, 24.22.3 and 26.13.1. CloudLinux’s patched alt-nodejs packages are already installed on all servers.
Node.js 20 and older no longer receive upstream fixes, but CloudLinux backported these patches to its older alt-nodejs versions, so they are covered too. Your app’s reported Node.js version will not change. Even so, we recommend moving to Node.js 22 or newer.
Linux Kernel
All servers are patched against several serious kernel flaws disclosed since August. Most are local root bugs, which become far more dangerous when paired with a remote foothold like php2shell.
- Infinity Core (CVE-2026-98260, CVE-2026-98256 and four more): six bugs in core kernel code, five with public exploits that take an ordinary user to root.
- bridge-stp-uaf (CVE-2026-72389): a use-after-free in the bridge STP timers that can be used for local root.
- CVE-2026-98432: a 9.8-rated TCP flaw that can be triggered remotely, with no account on the server.
- CVE-2026-98276: a UDP socket race that lets a local user crash the kernel or gain root.
More frequent reboots. Lately, critical kernel fixes have been available well before the matching KernelCare live patches. Rather than wait, we have been rebooting servers more often to apply them sooner.
What This Means for You
Nothing is required on your end: every fix above is already in place. Disclosures like these keep arriving faster, and many now come with working exploits on day one. That is why we monitor new vulnerabilities closely and patch as soon as fixes, or interim mitigations, become available.
The best thing you can do is keep your own software current: WordPress and other script installs as well as associated plugins and themes. As always, feel free to reach out to us if you have any questions or concerns.