Patch PHP CVE-2026-109618 / 109619 on DirectAdmin (CustomBuild)

Disclosed 21 October 2026. Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated remote code execution. On DirectAdmin, PHP is compiled by CustomBuild, so you patch it by rebuilding PHP to a fixed release. Your sites' files and databases are not touched.

Using cPanel? Follow the cPanel & CloudLinux guide. Using Plesk? See the Plesk guide.

Fixed PHP versions

PHP branch	Safe version
8.5	8.5.12 or later
8.4	8.4.27 or later
8.3	8.3.36 or later
8.2	8.2.35 or later
8.1 and older	No fix from the PHP project — see End-of-life PHP below

Step 1 — Check which PHP versions you have

Run as root:

da build versions | grep -i php

This lists every PHP version CustomBuild manages on your server, with the installed and the latest available release. You can also check one version directly — DirectAdmin installs each PHP under

Terminal

/usr/local/phpXY

Terminal

/usr/local/php83/bin/php -v

(Use php82, php84, php85 and so on for your other versions.) Anything older than the table above needs the update.

Step 2 — Update CustomBuild and rebuild PHP

Terminal

da build update
da build php

da build update refreshes CustomBuild's list of available versions so it knows about the fixed releases. da build php then rebuilds every PHP version configured on the server. Compiling takes roughly 10–30 minutes per PHP version; websites keep running and PHP restarts briefly at the end.

Older DirectAdmin servers that don't have the da command use the same steps from the CustomBuild folder:

Terminal

cd /usr/local/directadmin/custombuild
./build update
./build php

Step 3 — Verify

Run the Step 1 check again. Every PHP version should now show a version from the table above. If a website still reports the old version, restart that version's PHP-FPM service (replace 83 with your version):

Terminal

systemctl restart php-fpm83

CloudLinux servers (ALT-PHP)

If your DirectAdmin server runs CloudLinux, sites can also use ALT-PHP (selected in the PHP Selector). Those packages are separate from CustomBuild — update them too:

Terminal

yum update 'alt-php*'

Check them with:

for p in $(rpm -qa 'alt-php*-common' | sort); do echo "== $p"; rpm -q --changelog "$p" | grep -iE 'CVE-2026-10961[89]' || echo "   NOT fixed yet"; done

Any line showing "NOT fixed yet" still needs the update.

End-of-life PHP (7.4 / 8.0 / 8.1)

The PHP project no longer releases updates for 8.1 and older, so CustomBuild cannot build a fixed version of them. You have two options:

Move the sites to a supported PHP version (recommended). For example, to switch the primary PHP to 8.3:
Terminal
```
da build set php1_release 8.3
da build php
da build rewrite_confs
```
Check that your applications support the newer PHP version first.
CloudLinux servers: keep an older version through ALT-PHP with Extended Life Support (ELS), which is included with a CloudLinux licence from us. Enable it with
Terminal
```
tslzCLN --tuxcare
```
, then run
Terminal
```
yum update 'alt-php*'
```
and switch the affected sites to that ALT-PHP version in the PHP Selector.

Troubleshooting

The build stops with a download or compile error: run da build update again and retry da build php. Make sure the server has free disk space (df -h) — compiling PHP needs room in
Terminal
```
/usr/local
```
and
Terminal
```
/tmp
```
.
da build versions still shows an old "latest" version: CustomBuild's version list hasn't been refreshed yet — run da build update first.

Want us to patch it for you?

Open a ticket and share server access — our team will apply the update, restart PHP and verify every version for you.

DirectAdmin: How to Patch PHP CVE-2026-109618 & CVE-2026-109619 (Critical RCE)

Fixed PHP versions

Step 1 — Check which PHP versions you have

Step 2 — Update CustomBuild and rebuild PHP

Step 3 — Verify

CloudLinux servers (ALT-PHP)

End-of-life PHP (7.4 / 8.0 / 8.1)

Troubleshooting

Want us to patch it for you?