CPANEL has released security updates addressing two PHP2Shell flaws and a WP Toolkit bug that affect shared hosting environments. The patches cover three CVEs: CVE-2026-109618 and CVE-2026-109619 in PHP, and CVE-2026-107663 in WP Toolkit. The PHP fixes are rolled into EasyApache4 builds and various PHP 8.2.x to 8.5.x lines, with patched builds available for EA-php74, EA-php80 and EA-php81 as well. WP Toolkit 6.11.5 or later closes the vulnerability described in CVE-2026-107663. Administrators should update to the specified versions (8.2.35, 8.3.36, 8.4.27 or 8.5.12 for PHP; WP Toolkit 6.11.5+) to mitigate the risks.
Exploitation status is notable: attackers are actively exploiting PHP2Shell in the wild, with cPanel’s advisory describing “RCE via OOM corruption” and indicating that all shipped PHP versions may be vulnerable. By contrast, there are no public reports of exploitation for the WP Toolkit flaw to date. The vulnerabilities are especially dangerous on shared hosting, where one compromised site can threaten other sites on the same server.
The advisories emphasise updating all affected cPanel & WHM versions and EasyApache4 PHP builds promptly, and then checking changelogs for the CVE IDs to confirm patch status. The article reinforces that hosting providers should prioritise the cPanel PHP updates before addressing other components.