Security Advisory: Two critical remote code execution vulnerabilities have been identified in PHP: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) - 21 October 2026.
Read the advisory
Every new feature, improvement and fix we ship across our licenses, servers and support — newest first.
Server Support
Critical PHP Security Update Affecting All PHP-Based Systems
security
Two critical remote code execution vulnerabilities have been identified in PHP: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2).
resolution
Update PHP immediately to a security-patched version (8.5.12, 8.4.27, 8.3.36, or 8.2.35), or install a vendor-provided backported security fix. Apply updates through your hosting control panel (cPanel, Plesk, DirectAdmin, etc.) or your operating system package manager (yum, dnf, or apt), depending on your server configuration. Restart the affected PHP services after updating and verify that the security fixes have been applied.
Licensing
Virtualizor Licensing System
new
Added support for the new Virtualizor licensing system.
improved
Re-engineered the licensing core for improved stability and performance.
security
Strengthened licensing security and integrity verification.
fixed
Fixed license verification failures under certain conditions.
update
Please, Update our Virtualizor licensing script.
amslicensevr --check-updates
Server Support
Security Advisory: cPanel and WP Squared
security
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
security
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
security
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
resolution
Update to the latest patched version:
For WHM cPanel Servers
amslicensecp --update-cpanel
For WP Squared Servers
amslicensewp2 --update-wp2
Server Support
Security Advisory: cPanel and WP Squared
security
An authenticated cPanel account holder can escalate their privileges through cPanel's CalDAV and CardDAV functionality.
security
A permissions issue could allow a local user on the same server to access calendar and contact data belonging to other accounts.
resolution
Update to the latest patched version:
For WHM cPanel Servers
amslicensecp --update-cpanel
For WP Squared Servers
amslicensewp2 --update-wp2
Server Support
Security: LiteSpeed Enterprise security advisory - September 14, 2026
security
A malicious low-privilege website user could potentially gain root-level access to the server. This issue can bypass expected account isolation controls, including CageFS, allowing a malicious website user to potentially escape its restricted environment and gain root-level access to the server.
resolution
We strongly recommend upgrading all affected LiteSpeed Enterprise installations to LiteSpeed Web Server Enterprise v6.3.7 or later.
Using our litespeed license command
amslicensels --update-litespeed
Using litespeed updater script
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
Licensing
Backuply Licensing System
improved
Added support for the new Backuply licensing system.
Licensing
LiteSpeed Web Server Licensing System
new
Added Support for LiteSpeed v6.3.7.
fixed
LiteSpeed licensing issue when performing system updates.
Server Support
Security Advisory: cPanel and WP Squared
security
An authenticated cPanel account holder with mail-related privileges can create arbitrary files on the server through cPanel's EmailTrack functionality.
Fixed several edge cases that could affect license validation and recovery.
improved
Reworked core components and configuration handling to improve stability, reliability, and overall system behavior.
Enhanced system compatibility and recovery handling.
Licensing
CloudLinux Licensing System
improved
Improved CloudLinux license validation.
fixed
Fixed handling of repository URLs and configuration files.
bug
Minor bug fixes and general improvements.
Licensing
cPanel Licensing System
new
Added TuxCare ELS PHP management via amslicensecp --tuxcare-php with install, reinstall, remove, list, and repository controls. Run --tuxcare-php --help to view all available options.
fixed
Fixed SSL certificate generation for cPanel services.
security
Temporarily disabled Imunify360 cPanel Account Protection as a workaround for the current cPanel/Imunify360 compatibility issue, until an official fix is available.
improved
Minor bug fixes and general improvements.
Licensing
CloudLinux 10 Licensing Support Added
improved
Added full licensing support for CloudLinux 10.
new
TuxCare Endless Lifecycle Support (ELS) is now included free of charge with CloudLinux licenses.
update
Please, Update our CloudLinux licensing script.
amslicensecx --check-updates
Server Support
Security Advisory: Zapscape (CVE-2026-64561) KVM guest escape and local root: mitigation and kernel update for CloudLinux
security
Zapscape (CVE-2026-64561) is a vulnerability in the Linux kernel’s KVM code. It has two attack paths. On an affected host that runs virtual machines, a tenant with root inside their own guest can take root on the host. On affected shared-hosting servers that run no virtual machines at all, an ordinary user or a compromised website can create a throwaway guest of their own and attack the host kernel from inside it.
resolution
Mitigation before the KernelCare update is released:
If your server runs no virtual machines
Most shared-hosting servers are in this group. Unload the KVM modules to close both attack paths without requiring a reboot.
Check the current live value before making changes. Use kvm_intel on Intel-based hosts
cat /sys/module/kvm_intel/parameters/nested
Check the current live value before making changes, Use kvm_amd on AMD-based hosts.
cat /sys/module/kvm_amd/parameters/nested
Disable nested virtualization
Use this command on Intel-based hosts.
echo 'options kvm_intel nested=0' | sudo tee /etc/modprobe.d/zapscape.conf
Use this command on AMD-based hosts.
echo 'options kvm_amd nested=0' | sudo tee /etc/modprobe.d/zapscape.conf
Update KernelCare
If you are using our cPanel or CloudLinux license you have access to KernelCare license for free, To update and get the latest patch, run
amslicensekc
Or use this command:
kcarectl --update
Check if the Zapscape kernel patch is applied
Once updated, check whether the Zapscape kernel patch was applied to your kernel.
kcarectl --patch-info | grep 'CVE-2026-64561'
Licensing
LiteSpeed Web ADC v3.4.0 Now Available
new
[Feature] Add Anubis proof-of-work support.
[Feature] Add ALTCHA CAPTCHA support.
[Feature] Add Zstandard compression support.
and more!
fixed
Include all bug fixes applied to 3.3.x releases.
update
Update LiteSpeed Web ADC to v3.4.0
Using our litespeed ADC license command
amslicenselb --update-litespeed-adc
Using litespeed ADC updater script
/usr/local/lslb/admin/misc/lsup.sh -f -v 3.4.0
Licensing
LiteSpeed Web Server v6.3.6 Build 6 Now Available
bug
Address another HTTP/2 request body length corner case that caused `400` status codes from proxy backends
Allow '\' in query string for HTTP/2 and HTTP/3 request header
improved
Support multiple remote ACL URLs.
update
Update LiteSpeed Web Server to v6.3.6 Build 6
Using our litespeed license command
amslicensels --update-litespeed
Using litespeed updater script
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.6
Server Support
Security Advisory: OVSwrap (CVE-2026-64531) local root exploit
security
OVSwrap (CVE-2026-64531) is a vulnerability in the Linux kernel’s Open vSwitch action validation that lets any local unprivileged user become root. It is an upstream kernel bug, so it reaches the whole EL9 and EL10 family and several Debian and Ubuntu releases. A working public exploit exists.
resolution
Mitigation before the KernelCare update is released:
Block the module from loading
This stops the vulnerable module loading at boot on servers that do not need it.
If you are using our cPanel or CloudLinux license you have access to KernelCare license for free, To update and get the latest patch, run
amslicensekc
Or use this command:
kcarectl --update
Check if kernel patched
Once updated, you can check whether the OVSwrap kernel patch was applied to your kernel
kcarectl --patch-info | grep 'CVE-2026-64531'
Server Support
Security Advisory: cPanel and WP Squared
security
A local user's .forward file can trigger unsafe string expansion in Exim's redirect router, allowing command injection under certain pipe transport configurations.
security
A privilege escalation vulnerability exists in cPanel & WHM's database management functionality.
security
A vulnerability in the cPanel web server allows manipulation of cpsrvd responses under limited conditions.
