PHP Vulnerability Responses by Company

WebPros

Global cloud / infrastructure
Aliases / services
ウェブプロス / cPanel / シーパネル / Plesk / プレスク / WHM / WP Squared / WebPros
Official website
https://webpros.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

cPanel & WHM / EasyApache PHP

Response status
Fixes available; installation required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides hosting control panel products.

Fixes cover cPanel & WHM and EasyApache PHP; internal PHP also needs updating.

Scope: Release availability does not establish customer installation. Check ELS and repository conditions for older PHP.

What users should do

Update the panel, website PHP and internal PHP; verify changelogs.

Official service URL

Source URLs

  1. cPanel critical PHP security releasehttps://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619Response evidence

Plesk (website PHP / panel engines)

Response status
Fixes available; installation required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Website PHP 8.2–8.5 fixes cover Linux/Windows. Panel fixes are in 18.0.81 Update 4 and 18.0.80 Update 11.

Scope: Linux 7.4/8.0/8.1 fixes use October 21 builds. Older branches need paid-ELS checks.

What users should do

Update Plesk and all PHP handlers; check build dates for old branches.

Source URLs

  1. Plesk PHP and panel-engine fixeshttps://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-PleskResponse evidence

WP Squared

Response status
Fixed build 11.138.1.17 available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official table lists 11.138.1.17 as the fixed WP Squared build for both CVEs.

Scope: This is WP Squared release information, separate from WordPress core or WP Toolkit updates.

What users should do

Administrators should check installed versions and apply the fixed release.

Source URLs

  1. cPanel critical PHP security releasehttps://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619Response evidence
Related official sources
  1. cPanel critical PHP security releaseOfficial notice
  2. Plesk PHP and panel-engine fixesOfficial notice

Comments