PHP Vulnerability Responses by Company

Cloud Linux Inc.

Global cloud / infrastructure
Aliases / services
クラウドリナックス / Imunify360 / TuxCare / alt-php / ea-php / CloudLinux / Cloud Linux Inc. / KernelCare
Official website
https://www.cloudlinux.com/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

CloudLinux OS (alt-php / ea-php / native PHP)

Response status
alt-php, ea-php and native fixes available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides hosting operating systems, PHP maintenance, and server protection.

Patched packages are in stable repositories. An October 23 correction says to keep the ELS ALT PHP repository (php-els) enabled.

Scope: Describes package availability, not confirmed installation on customer servers. Follow the instructions for each OS and package family.

What users should do

Use the regular update for your OS and PHP stream, then restart PHP services. Re-enable php-els if you disabled it.

Official service URL

Source URLs

  1. CloudLinux Critical PHP vulnerabilities statushttps://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5Response evidence
  2. https://cloudlinux.statuspage.io/https://cloudlinux.statuspage.io/Service and operation documentation

TuxCare ELS for PHP / ELS for OS

Response status
Fixed packages available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Both CVE fixes are available: alt-php 5.2–8.5 through ELS for Runtimes, and supported native OS PHP through ELS for OS.

Scope: Coverage depends on OS, architecture and subscription. This does not establish KernelCare coverage.

What users should do

Check the build for your OS and PHP branch; update installed alt-php through the package manager.

Source URLs

  1. https://tuxcare.com/els-php2shell-patches-faq/https://tuxcare.com/els-php2shell-patches-faq/Response evidence
  2. https://tuxcare.com/cve-tracker/fixes/details/clsa-2026-1792612051/https://tuxcare.com/cve-tracker/fixes/details/clsa-2026-1792612051/Response evidence

Imunify360 WAF

Response status
Interim protection; PHP update required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

WAF rules block known exploit requests but do not fix every attack path.

Scope: Coverage differs across ModSecurity, Coraza and LiteSpeed; WAF alone is insufficient.

What users should do

Verify WAF updates and install a fixed PHP build.

Source URLs

  1. https://blog.imunify360.com/php-cve-2026-109618-cve-2026-109619/https://blog.imunify360.com/php-cve-2026-109618-cve-2026-109619/Response evidence

KernelCare

Response status
Not listed (KernelCare-specific response)
Response information checked
2026-10-27

Current re-audit: Official sources searched; no response found · Research date: 2026-10-27

KernelCare provides kernel live patches. No KernelCare-specific response to these PHP flaws was found.

Scope: TuxCare ELS PHP fixes are not evidence of a KernelCare PHP fix.

What users should do

Obtain a fixed PHP build from its provider and update PHP itself.

Source URLs

  1. https://tuxcare.com/enterprise-live-patching-services/kernelcare-enterprise/https://tuxcare.com/enterprise-live-patching-services/kernelcare-enterprise/Service and operation documentation
  2. https://tuxcare.com/els-php2shell-patches-faq/https://tuxcare.com/els-php2shell-patches-faq/Service and operation documentation
Related official sources
  1. CloudLinux Critical PHP vulnerabilities statusOfficial notice

Comments