All PHP versions we offer are patched against these two vulnerabilities. This covers 5.2, 5.3, 5.4, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, and 8.5. No action is needed on your part.
A note on version numbers: We run CloudLinux Hardened PHP, which back-ports security fixes into the existing release rather than bumping the version number. That means PHP 8.5.11, for example, is fully patched even though the number hasn't changed. If a security scanner flags your site based on the PHP version number alone, this is why. The fix is in place.
For anyone who wants to confirm it themselves, the package changelog shows the fixes:
# rpm -q alt-php85 --changelog | grep -E 'CVE-2026-(109618|109619)' -A2
- CVE-2026-109618: do not bail out from inside the memory manager; allocation
failures are reported through a deferred error instead of unwinding through
half-updated engine state
- CVE-2026-109619: clear stale request globals at shutdown so a bailout cannot
carry them into the next requestThis is for PHP 8.5, but this applies to all versions from 5.2 up to 8.5.
